{"id":"CVE-2022-20617","aliases":["EUVD-2022-0629","GHSA-jpxj-vgq5-prjc","RHSA-2022:0055","RHSA-2022:0339","RHSA-2022:0483","RHSA-2022:0491","RHSA-2022:0555","RHSA-2022:0565"],"status":"published","title":"OS command execution vulnerability in Jenkins Docker Commons Plugin","description":"Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02332,"percentile":0.83689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2022-01-12T19:05:53Z","modified":"2026-10-24T10:30:58Z","exploits":[{"source":"pocgithub","id":"shoucheng3/jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17","title":"shoucheng3/jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17","date":"2025-08-19","url":"https://github.com/shoucheng3/jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17"}],"fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:docker-commons","fixed_in":["1.18"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:docker-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:docker-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18"}]}],"versions":["1.0","1.0-alpha-1","1.0-alpha-10","1.0-alpha-11","1.0-alpha-12","1.0-alpha-13","1.0-alpha-14","1.0-alpha-4","1.0-alpha-5","1.0-alpha-6","1.0-alpha-7","1.0-alpha-8","1.0-alpha-9","1.0-beta-1","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.2","1.3","1.3.1","1.4.0","1.4.1","1.5","1.6","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.319.2.1643288987-1.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-bootinfra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-bootinfra-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.1643404185-1.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-92.rhaos4.10.gitdaab4d1.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-92.rhaos4.10.gitdaab4d1.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.1-9.rhaos4.10.gitbdffb9a.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.1-9.rhaos4.10.gitbdffb9a.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.1-9.rhaos4.10.gitbdffb9a.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.319.2.1643391771-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.1643389956-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.319.2.1643648617-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.1643649345-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.319.2.1643882372-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.1643883495-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.319.2.1644411558-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1644412543-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.319.2.1643964085-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.1643965689-1.el8"}]}],"bundled":2}],"products":[{"vendor":"jenkins","product":"docker_commons"},{"vendor":"jenkins project","product":"jenkins docker commons plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1878","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2022/01/12/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20617","tags":["advisory"]},{"url":"https://plugins.jenkins.io/docker-commons","tags":["web"]},{"url":"https://github.com/jenkinsci/docker-commons-plugin/commit/c069b79c31c5aa80a01b0c462f0dc6b41751f059","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jpxj-vgq5-prjc"},{"url":"https://github.com/jenkinsci/docker-commons-plugin","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0055","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051730","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0055.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-20319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20319","tags":["advisory"]},{"url":"https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21684","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2499","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21685","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020323","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21686","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21687","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21687","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21688","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21688","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21689","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21690","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21691","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020339","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21693","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020341","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21693","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21694","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21694","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21694","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21695","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21695","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020344","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21696","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2423","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21697","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21697","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2428","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020385","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21698","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2506","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41190","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41190","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41190","tags":["advisory"]},{"url":"https://github.com/moby/moby/security/advisories/GHSA-xmmx-7jpf-fx42","tags":["article"]},{"url":"https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m","tags":["article"]},{"url":"https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41772","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/0fM21h43arc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44716","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44716","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/hcmEScgc00k","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44717","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0532","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0532","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0532","tags":["advisory"]},{"url":"https://github.com/cri-o/cri-o/security/advisories/GHSA-w2j5-3rcx-vx7x","tags":["article"]},{"url":"https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-20612","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-20612","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20612","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2558","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-20617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-20617","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0339","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0339.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0483","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0483.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0491","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0491.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0555","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1636993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041983","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0555.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0565","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0565.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-20617","description":"Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.","status":"published","published":"2022-01-12T19:05:53Z","modified":"2024-08-03T02:17:52.926Z","updated_at":"2026-11-02T14:34:24.627322Z"}],"euvd":[{"id":"EUVD-2022-0629","description":"Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.","status":"published","published":"2022-01-12T19:05:53Z","modified":"2024-08-03T02:17:52Z","updated_at":"2026-11-03T03:25:54.509519Z"}],"ghsa":[{"id":"GHSA-jpxj-vgq5-prjc","title":"OS command execution vulnerability in Jenkins Docker Commons Plugin","description":"Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.","status":"published","published":"2022-01-13T00:01:03Z","modified":"2023-12-27T15:20:02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:37:28.753349Z"}],"nvd":[{"id":"CVE-2022-20617","description":"Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.","status":"published","published":"2022-01-12T20:15:08.907Z","modified":"2026-06-17T04:24:41.96Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:10.836864Z"}],"osv":[{"id":"CVE-2022-20617","description":"Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.","status":"published","published":"2022-01-12T20:15:08.907Z","modified":"2026-10-24T10:30:58.969155508Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"GHSA-jpxj-vgq5-prjc","title":"OS command execution vulnerability in Jenkins Docker Commons Plugin","description":"Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.","status":"published","published":"2022-01-13T00:01:03Z","modified":"2024-02-16T08:22:45.294775Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"RHSA-2022:0055","title":"Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update","status":"published","published":"2024-09-30T14:19:01Z","modified":"2026-08-20T10:02:39Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0339","title":"Red Hat Security Advisory: OpenShift Container Platform 4.9.19 security update","status":"published","published":"2024-09-16T07:16:23Z","modified":"2026-08-12T10:01:47Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0483","title":"Red Hat Security Advisory: OpenShift Container Platform 4.8.31 security update","status":"published","published":"2024-09-16T07:16:30Z","modified":"2026-08-12T10:01:47Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0491","title":"Red Hat Security Advisory: OpenShift Container Platform 4.7.43 security update","status":"published","published":"2024-09-16T07:16:38Z","modified":"2026-08-12T10:01:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0555","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11.634 security update","status":"published","published":"2024-09-16T07:16:46Z","modified":"2026-08-12T10:01:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0565","title":"Red Hat Security Advisory: OpenShift Container Platform 4.6.55 packages and security update","status":"published","published":"2024-09-16T07:16:54Z","modified":"2026-08-12T10:01:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"}]}}