⌘ + K

GHSA-264w-xrr7-6qqg

Dashboard / Vulnerabilities / GHSA-264w-xrr7-6qqg

GHSA-264w-xrr7-6qqg

Published: 24 May 2022Last Modified: 16 Feb 2024

Aliases:

CVE-2020-2167

Summary: RCE vulnerability in Jenkins OpenShift Pipeline Plugin

Details: OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to OpenShift Pipeline Plugin’s build step. OpenShift Pipeline Plugin 1.0.57 configures its YAML parser to only instantiate safe types.

References: https://nvd.nist.gov/vuln/detail/CVE-2020-2167, https://github.com/jenkinsci/openshift-pipeline-plugin, https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1739, http://www.openwall.com/lists/oss-security/2020/03/25/2

Affected packages

Package

Name: com.openshift.jenkins:openshift-pipeline

Purl: pkg:maven/com.openshift.jenkins/openshift-pipeline

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -1.0.57

Affected versions

1.0

1.0.1

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.15

1.0.16

1.0.17

1.0.18

1.0.19

1.0.2

1.0.20

1.0.21

1.0.22

1.0.23

1.0.24

1.0.25

1.0.26

1.0.27

1.0.28

1.0.29

1.0.3

1.0.30

1.0.31

1.0.32

1.0.33

1.0.34

1.0.35

1.0.36

1.0.37

1.0.38

1.0.39

1.0.4

1.0.40

1.0.41

1.0.42

1.0.43

1.0.44

1.0.45

1.0.46

1.0.47

1.0.48

1.0.49

1.0.5

1.0.50

1.0.51

1.0.52

1.0.53

1.0.54

1.0.55

1.0.56

1.0.6

1.0.7

1.0.8

1.0.9

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High