PT-2020-15376 · Jenkins · Jenkins Literate Plugin+1

Published 2020-03-09 · Updated 2023-10-25 · CVE-2020-2158

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Literate Plugin versions 1.0 and earlier

Description The issue results from the Jenkins Literate Plugin not configuring its YAML parser to prevent the instantiation of arbitrary types, leading to a remote code execution vulnerability.

Recommendations For Jenkins Literate Plugin versions 1.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-2158

GHSA-C329-R874-XC7J

Affected Products

Jenkins

Jenkins Literate Plugin

References · 7

• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1750 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2158 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2158 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c329-r874-xc7j · Vendor Advisory
• https://github.com/jenkinsci/literate-plugin · Note
• http://openwall.com/lists/oss-security/2020/03/09/1 · Note
• https://t.me/cvenotify/1416 · Telegram Post