PT-2018-9245 · Jenkins · Jenkins Pipeline: Supporting Apis Plugin+1

Aleksandr Kazakov · Published 2018-02-09 · Updated 2022-05-14 · CVE-2018-1000058

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Supporting APIs Plugin versions 2.17 and earlier

Description: The issue is related to incomplete sandbox protection, allowing arbitrary code execution. Methods like readResolve implemented in Pipeline scripts, related to Java deserialization, were not subject to sandbox protection and could execute arbitrary code. This could be exploited by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.

Recommendations: For Jenkins Pipeline: Supporting APIs Plugin versions 2.17 and earlier, update to a version later than 2.17 to resolve the issue. As a temporary workaround, consider restricting the permission to configure Pipelines in Jenkins to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-1000058

GHSA-P3G4-9XFV-WQ9V

Affected Products

Jenkins

Jenkins Pipeline: Supporting Apis Plugin

References · 5

• https://osv.dev/vulnerability/CVE-2018-1000058 · Vendor Advisory
• https://jenkins.io/security/advisory/2018-02-05 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000058 · Security Note
• https://osv.dev/vulnerability/GHSA-p3g4-9xfv-wq9v · Vendor Advisory
• http://securityfocus.com/bid/103034 · Note