Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.jenkins-ci.plugins:docker-commons

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5MavenPublished

    Jenkins Docker Commons Plugin allows any user with Overall/Read permission to get list of valid credentials IDs

    CVE-2017-1000094 · GHSA-69cj-g7mw-mh72

    Affected
    • Maven org.jenkins-ci.plugins:docker-commons < 1.8
    Fixed in
    1.8· Vendor fix available
    Issue
    Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to authenticate with a Docker Registry. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability. An enumeration of credentials IDs in this plugin now requires the permission to have Extended Read permission (when that permission is enabled; otherwise Configure permission) to the job in whose context credentials are being accessed. If no job context exists, Overall/Administer permission is required.

    Recommended action: Upgrade to 1.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 8.8MavenPublished

    OS command execution vulnerability in Jenkins Docker Commons Plugin

    CVE-2022-20617 · GHSA-jpxj-vgq5-prjc

    Affected
    • Maven org.jenkins-ci.plugins:docker-commons < 1.18
    Fixed in
    1.18· Vendor fix available
    Issue
    Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.

    Recommended action: Upgrade to 1.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →