diff --git a/advisories/github-reviewed/2022/05/GHSA-m8r4-c7jm-w782/GHSA-m8r4-c7jm-w782.json b/advisories/github-reviewed/2022/05/GHSA-m8r4-c7jm-w782/GHSA-m8r4-c7jm-w782.json index 9a67dfe85af..d20c8319e6e 100644 --- a/advisories/github-reviewed/2022/05/GHSA-m8r4-c7jm-w782/GHSA-m8r4-c7jm-w782.json +++ b/advisories/github-reviewed/2022/05/GHSA-m8r4-c7jm-w782/GHSA-m8r4-c7jm-w782.json @@ -1,17 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-m8r4-c7jm-w782", - "modified": "2022-12-16T22:12:33Z", + "modified": "2023-10-27T13:19:38Z", "published": "2022-05-24T17:35:09Z", "aliases": [ "CVE-2020-2320" ], "summary": "Jenkins Plugin Installation Manager Tool did not verify plugin downloads", - "details": "Plugin Installation Manager Tool is part of the Jenkins project Docker images. As `jenkins-plugin-cli` it is used to download and install plugins even before Jenkins is running.\n\nPlugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. This may allow third parties such as mirror operators to provide crafted plugin downloads.\n\nPlugin Installation Manager Tool 2.2.0 confirms that actual checksums of downloaded plugin match the expected checksums.\n\nDocker images of Jenkins 2.269 and 2.263.1 contain Plugin Installation Manager Tool 2.2.0. Users of older Docker images can change the version they use by extending the Jenkins image and update the tool themselves with:\n\nARG PLUGIN_CLI_URL=https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/2.2.0/jenkins-plugin-manager-2.2.0.jar\nRUN curl -fsSL ${PLUGIN_CLI_URL} -o /usr/lib/jenkins-plugin-manager.jar\nJenkinsfile Runner [1.0-beta-22](https://github.com/jenkinsci/jenkinsfile-runner/releases/tag/1.0-beta-22) Docker images also include Plugin Installation Manager Tool 2.2.0.", + "details": "Jenkins Plugin Installation Manager Tool is part of the Jenkins project Docker images. As `jenkins-plugin-cli` it is used to download and install plugins even before Jenkins is running.\n\nJenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. This may allow third parties such as mirror operators to provide crafted plugin downloads.\n\nJenkins Plugin Installation Manager Tool 2.2.0 confirms that actual checksums of downloaded plugin match the expected checksums.\n\nDocker images of Jenkins 2.269 and 2.263.1 contain Plugin Installation Manager Tool 2.2.0. Users of older Docker images can change the version they use by extending the Jenkins image and update the tool themselves with:\n\nARG PLUGIN_CLI_URL=https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/2.2.0/jenkins-plugin-manager-2.2.0.jar\nRUN curl -fsSL ${PLUGIN_CLI_URL} -o /usr/lib/jenkins-plugin-manager.jar\nJenkinsfile Runner [1.0-beta-22](https://github.com/jenkinsci/jenkinsfile-runner/releases/tag/1.0-beta-22) Docker images also include Plugin Installation Manager Tool 2.2.0.", "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ @@ -61,7 +61,7 @@ "cwe_ids": [ "CWE-494" ], - "severity": "HIGH", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2022-09-07T23:54:44Z", "nvd_published_at": "2020-12-03T16:15:00Z"