Vulnerabilities in pkg:maven/org.jenkins-ci.plugins/pipeline-utility-steps

PACKAGE
Advisory Identifier: GHSA-6987-xccv-fhjp
Share
Advisory Summary

CVE-2023-32981 is a MODERATE (CVSS 6.3) jenkins pipeline utility steps plugin vulnerability (CWE-787: Out-of-bounds Write) affecting Pipeline utility steps libraries in the Maven ecosystem. The issue involves jenkins pipeline utility steps plugin arbitrary file write vulnerability. Remediation is available by upgrading affected packages to version 2.15.3.

2 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:maven/org.jenkins-ci.plugins/pipeline-utility-steps

2 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:maven/org.jenkins-ci.plugins/pipeline-utility-steps. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-6987-xccv-fhjp CVE-2023-32981 MODERATE Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability
GHSA-3g9q-cmgv-g4p6 CVE-2022-45381 HIGH Arbitrary file read vulnerability in Jenkins Pipeline Utility Steps Plugin

CVE-2023-32981 at a Glance

CVE Identifier CVE-2023-32981
GHSA Identifier GHSA-6987-xccv-fhjp
Severity MODERATE
CVSS v3.1 Base Score 6.3
CWE Classification CWE-787: Out-of-bounds Write
Affected Product Pipeline utility steps
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 6.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity Low (I:L)
Availability Low (A:L)

How to Fix CVE-2023-32981

To remediate this vulnerability, upgrade all affected Pipeline utility steps dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.jenkins-ci.plugins:pipeline-utility-steps fixed: 2.15.3 
<dependency>
    <groupId>org.jenkins-ci.plugins</groupId>
    <artifactId>pipeline-utility-steps</artifactId>
    <version>2.15.3</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.jenkins-ci.plugins

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2023-32981, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.jenkins-ci.plugins

Analyze the terminal output to locate any version of Pipeline utility steps in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.15.3), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.jenkins-ci.plugins command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-787: Out-of-bounds Write, where the product writes data past the end, or before the beginning, of the intended buffer. In Pipeline utility steps, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Jenkins Pipeline Utility Steps Plugin provides the `untar` and `unzip` Pipeline steps to extract archives into job workspaces. Pipeline Utility Steps Plugin 2.15.2 and earlier does not validate or limit file paths of files contained within these archives. This allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content. Pipeline Utility Steps Plugin 2.15.3 rejects extraction of files in `tar` and `zip` archives that would be placed outside the expected destination directory.

CVE-2023-32981 Affected Pipeline utility steps Versions

1 component(s)
Fixed Versions:
2.15.3
Product / Package Ecosystem Affected Versions Fixed Version
org.jenkins-ci.plugins:pipeline-utility-steps
maven/org.jenkins-ci.plugins/pipeline-utility-steps
Maven
< 2.15.3
2.15.3

References

NVD — CVE-2023-32981 NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32981
Security Fix Commit FIX COMMIT
https://github.com/jenkinsci/pipeline-utility-steps-plugin/commit/0ba4f329ee27c023609653e25bdd5604c5e46a11
Pipeline utility steps Security Information SECURITY
https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2196

Frequently Asked Questions

What is CVE-2023-32981?
CVE-2023-32981 is a security vulnerability in Pipeline utility steps involving Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability under CWE-787: Out-of-bounds Write.
Which Pipeline utility steps versions are affected?
Affected versions include releases prior to 2.15.3 across affected packages: org.jenkins-ci.plugins:pipeline-utility-steps.
What version fixes CVE-2023-32981?
Upgrading to 2.15.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is pipeline-utility-steps affected?
Yes, org.jenkins-ci.plugins:pipeline-utility-steps is affected in releases prior to 2.15.3. Upgrade your dependency to 2.15.3 or later.
What is the CVSS score of CVE-2023-32981?
CVE-2023-32981 has a CVSS v3.1 base score of 6.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
What CWE is associated with CVE-2023-32981?
CVE-2023-32981 is classified under CWE-787: Out-of-bounds Write (The product writes data past the end, or before the beginning, of the intended buffer.).
How can I check Maven dependencies for CVE-2023-32981?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.jenkins-ci.plugins'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6987-xccv-fhjp",
  "modified" : "2023-05-17T02:59:30Z",
  "published" : "2023-05-16T18:30:16Z",
  "aliases" : [ "CVE-2023-32981" ],
  "summary" : "Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability",
  "details" : "Jenkins Pipeline Utility Steps Plugin provides the `untar` and `unzip` Pipeline steps to extract archives into job workspaces.\n\nPipeline Utility Steps Plugin 2.15.2 and earlier does not validate or limit file paths of files contained within these archives.\n\nThis allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.\n\nPipeline Utility Steps Plugin 2.15.3 rejects extraction of files in `tar` and `zip` archives that would be placed outside the expected destination directory.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.jenkins-ci.plugins:pipeline-utility-steps"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.15.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-32981"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jenkinsci/pipeline-utility-steps-plugin/commit/0ba4f329ee27c023609653e25bdd5604c5e46a11"
  }, {
    "type" : "WEB",
    "url" : "https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2196"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-787" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-05-17T02:59:30Z",
    "nvd_published_at" : "2023-05-16T16:15:10Z"
  }
}