Description
Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Docker Commons Plugin | unspecified – ≤ 1.17 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | coreos-installer +1 | 0.12.0-1.rhaos4.10.el8 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | cri-o | 1.23.0-92.rhaos4.10.gitdaab4d1.el7 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | jenkins | 2.319.2.1643288987-1.el8 | RHSA-2022:0565, RHSA-2022:0491, RHSA-2022:0483 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.6.1643965689-1.el8 | RHSA-2022:0565, RHSA-2022:0491, RHSA-2022:0483 |
| Red Hat OpenShift 4 | openshift +1 | 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 | RHSA-2022:0055 |
| Red Hat OpenShift 3 | jenkins | 2.319.2.1644411558-1.el7 | RHSA-2022:0555 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1644412543-1.el7 | RHSA-2022:0555 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
shoucheng3/jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17 ★ 0 · Aug 19, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:docker-commons | < 1.18 | 1.18 | GHSA-jpxj-vgq5-prjc |
Advisories 6
- RHSA-2022:0055 Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2022:0565 Red Hat Security Advisory: OpenShift Container Platform 4.6.55 packages and security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2022:0491 Red Hat Security Advisory: OpenShift Container Platform 4.7.43 security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2022:0555 Red Hat Security Advisory: OpenShift Container Platform 3.11.634 security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2022:0339 Red Hat Security Advisory: OpenShift Container Platform 4.9.19 security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2022:0483 Red Hat Security Advisory: OpenShift Container Platform 4.8.31 security update Red Hat Security Advisories (RHSA) · Aug 12, 2026