Bug 2134344 (CVE-2022-25914)

Summary:	CVE-2022-25914 jib-core: RCE via the isDockerInstalled
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, anstephe, avibelli, bgeorges, chazlett, clement.escoffier, dandread, dkreling, gmalinko, gsmet, hamadhan, janstey, jochrist, jpavlik, jwon, lthon, pdelbell, peholase, pgallagh, pjindal, probinso, rruss, rsvoboda, sbiarozk, sdouglas
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	jib-core 0.22.0	Doc Type:	---
Doc Text:	A flaw was found in the jib-core package. This flaw allows an attacker to execute remote code into its target.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-01-28 22:52:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2125448

Description Patrick Del Bello 2022-10-13 08:04:15 UTC

The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution (RCE) via the isDockerInstalled function, due to attempting to execute input.

https://github.com/GoogleContainerTools/jib/pull/3744
https://security.snyk.io/vuln/SNYK-JAVA-COMGOOGLECLOUDTOOLS-2968871
https://github.com/GoogleContainerTools/jib/commit/67fa40bc2c484da0546333914ea07a89fe44eaaf

Comment 4 errata-xmlrpc 2023-01-26 12:14:54 UTC

This issue has been addressed in the following products:

  Migration Toolkit for Runtimes 1 on RHEL 8

Via RHSA-2023:0471 https://access.redhat.com/errata/RHSA-2023:0471

Comment 5 Product Security DevOps Team 2023-01-28 22:52:09 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-25914