Executive brief
Woodpecker's custom environment variables allow to alter execution flow of plugins in go.woodpecker-ci.org/woodpecker
Affected products
- Go go.woodpecker-ci.org/woodpecker
- Go go.woodpecker-ci.org/woodpecker/v2
Junglewise Threat Intelligence
CVE-2024-41122: GO-2024-2998 - Woodpecker's custom environment variables allow to alter execution flow of plugins in go.woodpecker-ci.org/woodpecker
CVE-2024-41122 · Severity: low · CVSS 3.1 · Published 2024-08-06
Technologies: go.woodpecker-ci.org/woodpecker (Go), go.woodpecker-ci.org/woodpecker/v2 (Go). Vendors: Go.
Related threats
- Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.ser
- Woodpecker CI agent impersonation via gRPC metadata injection
- GO-2024-2999 - Woodpecker's custom workspace allow to overwrite plugin entrypoint executable in go.woodpecker-ci.org/woodpecker