PT-2018-9318 · Liquibase+1 · Liquibase Runner Plugin+1

Yoann Dubreuil · Publicado 2018-04-05 · Atualizado 2022-05-13 · CVE-2018-1000146

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Liquibase Runner Plugin versions 1.3.0 and older

Description An arbitrary code execution issue exists that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM.

Recommendations For Liquibase Runner Plugin versions 1.3.0 and older, update to a version newer than 1.3.0 to resolve the issue.

Correção

Identificadores relacionados

CVE-2018-1000146

GHSA-3HVC-XWJP-XR8M

Produtos afetados

Jenkins

Liquibase Runner Plugin

Referências · 8

• https://github.com/jenkinsci/liquibase-runner-plugin/commit/382a1ea84910db28a88089306b24d1e80818f0a5 · Nota
• https://github.com/jenkinsci/liquibase-runner-plugin · Nota
• https://github.com/jenkinsci/liquibase-runner-plugin/commit/1817af0b5bb17e690d89c0a1623de8bd47f8c1a1 · Nota
• https://github.com/jenkinsci/liquibase-runner-plugin/commit/7726ce4569a287e32fbda6f01ad2846ada909436 · Nota
• https://osv.dev/vulnerability/GHSA-3hvc-xwjp-xr8m · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000146 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000146 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2018-03-26/#SECURITY-519 · Aviso do Fabricante