PT-2018-9245 · Jenkins · Jenkins Pipeline: Supporting Apis Plugin+1

Aleksandr Kazakov · Publicado 2018-02-09 · Atualizado 2022-05-14 · CVE-2018-1000058

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Supporting APIs Plugin versions 2.17 and earlier

Description: The issue is related to incomplete sandbox protection, allowing arbitrary code execution. Methods like readResolve implemented in Pipeline scripts, related to Java deserialization, were not subject to sandbox protection and could execute arbitrary code. This could be exploited by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.

Recommendations: For Jenkins Pipeline: Supporting APIs Plugin versions 2.17 and earlier, update to a version later than 2.17 to resolve the issue. As a temporary workaround, consider restricting the permission to configure Pipelines in Jenkins to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2018-1000058

GHSA-P3G4-9XFV-WQ9V

Produtos afetados

Jenkins

Jenkins Pipeline: Supporting Apis Plugin

Referências · 5

• https://osv.dev/vulnerability/CVE-2018-1000058 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2018-02-05 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000058 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-p3g4-9xfv-wq9v · Aviso do Fabricante
• http://securityfocus.com/bid/103034 · Nota