Skip to content
Fencer Vulns
high 8.8

CVE-2022-20617 json

OS command execution vulnerability in Jenkins Docker Commons Plugin

published 2022-01-12 4 y ago modified 2026-06-17 4 mo ago also GHSA-jpxj-vgq5-prjc , EUVD-2022-0629

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.

Patch / fix

  • maven org.jenkins-ci.plugins:docker-commons 1.18
  • cri-o openshift 4.10 1.23.0-92.rhaos4.10.gitdaab4d1.el7
  • cri-o openshift 4.10 1.23.1-9.rhaos4.10.gitbdffb9a.el8
  • jenkins openshift 4.10 2.319.2.1643288987-1.el8
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
  • coreos-installer openshift 4.10 0.12.0-1.rhaos4.10.el8
  • jenkins-2-plugins openshift 4.10 4.10.1643404185-1.el8
  • openshift-clients openshift 4.10 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7

red hat advisories RHSA-2022:0055RHSA-2022:0565RHSA-2022:0555RHSA-2022:0491RHSA-2022:0483RHSA-2022:0339

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-20617 updated cvss 8.8

jenkins-2-plugins/docker-commons: does not sanitize the name of an image or a tag which could result in an OS command execution

  • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins 3.11.1644412543-1.el7
    fixed: vendor fix RHSA-2022:0555
  • Red Hat OpenShift Container Platform 4.6 jenkins-2-plugins 4.6.1643965689-1.el8
    fixed: vendor fix RHSA-2022:0565
  • Red Hat OpenShift Container Platform 4.7 jenkins-2-plugins 4.7.1643883495-1.el8
    fixed: vendor fix RHSA-2022:0491
  • Red Hat OpenShift Container Platform 4.8 jenkins-2-plugins 4.8.1643649345-1.el8
    fixed: vendor fix RHSA-2022:0483
  • Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins 4.9.1643389956-1.el8
    fixed: vendor fix RHSA-2022:0339
  • Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins 4.10.1643404185-1.el8
    fixed: vendor fix RHSA-2022:0055
  • Red Hat OpenShift Container Platform 3.11 jenkins 2.319.2.1644411558-1.el7, prometheus 3.11.634-1.g99aae51.el7, openshift-kuryr 3.11.634-1.g0c4bf66.el7, openshift-kuryr-cni 3.11.634-1.g0c4bf66.el7, atomic-openshift 3.11.634-1.git.0.9b5be6d.el7, openshift-ansible 3.11.634-1.git.0.86bbe6f.el7, +35 more Red Hat OpenShift Container Platform 4.6 jenkins 2.319.2.1643964085-1.el8, cri-o 1.19.4-6.rhaos4.6.git391175b.el7, cri-o 1.19.4-6.rhaos4.6.git391175b.el8, openshift 4.6.0-202201200342.p0.g35fca9a.assembly.stream.el7, openshift 4.6.0-202201200342.p0.g35fca9a.assembly.stream.el8, openshift-kuryr 4.6.0-202201261116.p0.g74cd766.assembly.stream.el8, +6 more Red Hat OpenShift Container Platform 4.7 jenkins 2.319.2.1643882372-1.el8 Red Hat OpenShift Container Platform 4.8 jenkins 2.319.2.1643648617-1.el8, containers-common 1-15.rhaos4.8.el8, cri-o 1.21.4-10.rhaos4.8.gitc058478.el7, cri-o 1.21.4-10.rhaos4.8.gitc058478.el8, openshift 4.8.0-202202050715.p0.gb82a451.assembly.stream.el7, openshift 4.8.0-202202050715.p0.gb82a451.assembly.stream.el8, +6 more Red Hat OpenShift Container Platform 4.9 jenkins 2.319.2.1643391771-1.el8, openshift 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el7, openshift 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8, openshift-hyperkube 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el7, openshift-hyperkube 4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8 Red Hat OpenShift Container Platform 4.10 buildah 1.19.7-1.el8, haproxy 2.2.19-1.el8, cri-tools 1.23.0-1.el7, cri-tools 1.23.0-1.el8, python-pbr 5.5.1-1.el8ost, buildah-tests 1.19.7-1.el8, +164 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.33% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.jenkins-ci.plugins:docker-commons
<1.18
1.18

Affected products

  • Jenkins project Jenkins Docker Commons Plugin

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.