PT-2020-15328 · Jenkins · Jenkins Google Kubernetes Engine Plugin+1

Daniel Kalinowski · Published 2020-02-12 · Updated 2023-10-25 · CVE-2020-2121

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Google Kubernetes Engine Plugin versions 0.8.0 and earlier

Description The issue is related to the configuration of the YAML parser in the Jenkins Google Kubernetes Engine Plugin, which does not prevent the instantiation of arbitrary types. This results in a remote code execution vulnerability that can be exploited by users who can provide YAML input files to the plugin's build step.

Recommendations For Jenkins Google Kubernetes Engine Plugin versions 0.8.0 and earlier, update to version 0.8.1 or later, which configures its YAML parser to only instantiate safe types.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-2121

GHSA-WF76-QGQQ-GCFJ

Affected Products

Jenkins

Jenkins Google Kubernetes Engine Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2121 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2121 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wf76-qgqq-gcfj · Vendor Advisory
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1731 · Vendor Advisory
• https://github.com/jenkinsci/google-kubernetes-engine-plugin · Note
• http://openwall.com/lists/oss-security/2020/02/12/3 · Note
• https://t.me/cvenotify/920 · Telegram Post