CVE-2022-25914 (published 2022-09-08T05:15Z)

The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution (RCE) via the isDockerInstalled function, due to attempting to execute input.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/GoogleContainerTools/jib
commit_details: repo_url: https://github.com/GoogleContainerTools/jib
author: Mridula
author_date: 2022-08-25 16:23:29-04:00
msg: Check if file exists when executable path is passed in through jib dockerClient.executable (#3744)

* Check if file exists when executable path is passed in through jib.dockerClient.executable
repository: repo_url: https://github.com/GoogleContainerTools/jib
repo_name: GoogleContainerTools/jib
description: 🏗 Build container images for your Java applications.
repo_language: Java
owner: GoogleContainerTools
file_changes: filename: CliDockerClient.java
change_type: ModificationType.MODIFY
diff: @@ -103,30 +103,28 @@ public class CliDockerClient implements DockerClient {
   public static final Path DEFAULT_DOCKER_CLIENT = Paths.get("docker");
 
   /**
-   * Checks if Docker is installed on the user's system and accessible by running the default {@code
-   * docker} command.
+   * Checks if Docker is installed on the user's system by running the `docker` command.
    *
    * @return {@code true} if Docker is installed on the user's system and accessible
    */
   public static boolean isDefaultDockerInstalled() {
-    return isDockerInstalled(DEFAULT_DOCKER_CLIENT);
+    try {
+      new ProcessBuilder(DEFAULT_DOCKER_CLIENT.toString()).start();
+      return true;
+    } catch (IOException ex) {
+      return false;
+    }
   }
 
   /**
-   * Checks if Docker is installed on the user's system and accessible by running the given {@code
-   * docker} executable.
+   * Checks if Docker is installed on the user's system and by verifying if the executable path
+   * provided has the appropriate permissions.
    *
    * @param dockerExecutable path to the executable to test running
    * @return {@code true} if Docker is installed on the user's system and accessible
    */
   public static boolean isDockerInstalled(Path dockerExecutable) {
-    try {
-      new ProcessBuilder(dockerExecutable.toString()).start();
-      return true;
-
-    } catch (IOException ex) {
-      return false;
-    }
+    return Files.exists(dockerExecutable);
   }
 
   /**

programming_language: Java
filename: CliDockerClientTest.java
change_type: ModificationType.MODIFY
diff: @@ -24,11 +24,13 @@ import com.google.cloud.tools.jib.image.ImageTarball;
 import com.google.cloud.tools.jib.json.JsonTemplateMapper;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.io.ByteStreams;
+import com.google.common.io.Resources;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.net.URISyntaxException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Paths;
 import java.security.DigestException;
@@ -74,6 +76,13 @@ public class CliDockerClientTest {
     Assert.assertFalse(CliDockerClient.isDockerInstalled(Paths.get("path/to/nonexistent/file")));
   }
 
+  @Test
+  public void testIsDockerInstalled_pass() throws URISyntaxException {
+    Assert.assertTrue(
+        CliDockerClient.isDockerInstalled(
+            Paths.get(Resources.getResource("core/docker/emptyFile").toURI())));
+  }
+
   @Test
   public void testLoad() throws IOException, InterruptedException {
     DockerClient testDockerClient =

programming_language: Java
filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -290,7 +290,7 @@ Property | Type | Default | Description
 
 Property | Type | Default | Description
 --- | --- | --- | ---
-`executable` | `File` | `docker` | Sets the path to the Docker executable that is called to load the image into the Docker daemon.
+`executable` | `File` | `docker` | Sets the path to the Docker executable that is called to load the image into the Docker daemon. **Please note**: Users are responsible for ensuring that the Docker path passed in is valid and has the right permissions to be executed.
 `environment` | `Map<String, String>` | *None* | Sets environment variables used by the Docker executable.
 
 #### System Properties

programming_language: Markdown
filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -341,7 +341,7 @@ Property | Type | Default | Description
 
 Property | Type | Default | Description
 --- | --- | --- | ---
-`executable` | string | `docker` | Sets the path to the Docker executable that is called to load the image into the Docker daemon.
+`executable` | string | `docker` | Sets the path to the Docker executable that is called to load the image into the Docker daemon. **Please note**: Users are responsible for ensuring that the Docker path passed in is valid and has the right permissions to be executed.
 `environment` | map | *None* | Sets environment variables used by the Docker executable.
 
 #### System Properties

programming_language: Markdown