CVE-2022-45379
High
Description
Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collision attacks.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Jenkins Script Security
PublishedNov 15, 2022
First seenNov 15, 2022
How to fix
Update
- jenkins script_security1190.v65867a_a_47126 or later
- org.jenkins-ci.plugins:script-security1190.v65867a_a_47126 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jenkins script_security | v < 1190.v65867a_a_47126 | 1190.v65867a_a_47126 |
| org.jenkins-ci.plugins:script-securityMaven | v < 1190.v65867a_a_47126 | 1190.v65867a_a_47126 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.