Jenkins Security Advisory 2022-08-23

Affects plugin: CollabNet Plugins Affects plugin: Git Affects plugin: Job Configuration History Affects plugin: Kubernetes Continuous Deploy

CSIRTS triage

What: Multiple plugins in Jenkins are affected by various vulnerabilities.
Who is affected: Deployments of Jenkins with the affected plugins.
Urgency: Remediation is urgent due to the potential for exploitation, although the severity is unknown.
Action: Update the affected plugins to their latest versions.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Jenkins

Get an email when a new Jenkins advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2022-386630.90% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 56% of all EPSS-scored CVEs.
Low exploitation riskCVE-2022-386640.68% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all EPSS-scored CVEs.
Low exploitation riskCVE-2022-386650.81% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 54% of all EPSS-scored CVEs.
Low exploitation riskCVE-2021-257380.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2022-38663	coverage & exploitation status	NVD · CVE.org
CVE-2022-38664	coverage & exploitation status	NVD · CVE.org
CVE-2022-38665	coverage & exploitation status	NVD · CVE.org
CVE-2021-25738	coverage & exploitation status	NVD · CVE.org