CVE-2022-1249

What it actually does

A NULL pointer dereference in cms_set_pw_data() of cms_common.c fails to handle NULL pwdata passed from daemon.c, causing an immediate crash on all daemonization attempts.

Why it matters to the business

Unexpected crashes interrupt automated signing operations in build and CI pipelines, creating downtime and requiring manual restarts or workarounds until patched.

How an attack unfolds

An attacker with local access triggers the daemon code path that supplies NULL pwdata to cms_set_pw_data, forcing an explicit NULL dereference and process termination; no remote vector or code execution is involved.

How to fix it

Upgrade jenkinsci/job-import-plugin to commit 85ccf218080d99aad861e766e0c7a2e421025735; rebuild and redeploy any affected images or packages that embed the vulnerable code.

How to confirm the fix worked

Confirm the patched commit is present, then exercise pesign daemon startup paths and verify no crash occurs on NULL pwdata handling.

Typical attack path

1. Gain local access to a host running the affected component
2. Invoke pesign daemonization with parameters that pass NULL pwdata
3. Trigger repeated crashes to achieve denial of service

How to detect it

Search process and system logs for pesign crashes or segmentation faults occurring during daemon startup; correlate with attempts to invoke the affected code path.

• cms_set_pw_data
• NULL pointer dereference
• pesign.*daemon
• segmentation fault.*pesign

What your security team should do

• Apply the referenced commit to all instances within the next maintenance window
• Add monitoring for pesign segmentation faults in system logs
• Limit local execution privileges for signing utilities to trusted processes only