PT-2018-9318 · Liquibase+1 · Liquibase Runner Plugin+1

Yoann Dubreuil · Published 2018-04-05 · Updated 2022-05-13 · CVE-2018-1000146

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Liquibase Runner Plugin versions 1.3.0 and older

Description An arbitrary code execution issue exists that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM.

Recommendations For Liquibase Runner Plugin versions 1.3.0 and older, update to a version newer than 1.3.0 to resolve the issue.

Fix

Related Identifiers

CVE-2018-1000146

GHSA-3HVC-XWJP-XR8M

Affected Products

Jenkins

Liquibase Runner Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-3hvc-xwjp-xr8m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000146 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000146 · Vendor Advisory
• https://jenkins.io/security/advisory/2018-03-26/#SECURITY-519 · Vendor Advisory
• https://github.com/jenkinsci/liquibase-runner-plugin/commit/382a1ea84910db28a88089306b24d1e80818f0a5 · Note
• https://github.com/jenkinsci/liquibase-runner-plugin · Note
• https://github.com/jenkinsci/liquibase-runner-plugin/commit/1817af0b5bb17e690d89c0a1623de8bd47f8c1a1 · Note
• https://github.com/jenkinsci/liquibase-runner-plugin/commit/7726ce4569a287e32fbda6f01ad2846ada909436 · Note