PT-2020-15392 · Jenkins · Jenkins Yaml Axis Plugin+1

Srikanth Ramu · Published 2020-04-16 · Updated 2023-10-25 · CVE-2020-2179

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Yaml Axis Plugin versions 0.2.0 and earlier

Description The issue results from the YAML parser not being configured to prevent the instantiation of arbitrary types, leading to a remote code execution vulnerability. This vulnerability is exploitable by users who can configure a multi-configuration job or control the contents of a previously configured job's SCM repository.

Recommendations For Jenkins Yaml Axis Plugin versions 0.2.0 and earlier, update to version 0.2.1 or later, which configures its YAML parser to only instantiate safe types.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-2179

GHSA-324H-2V7H-Q3XX

Affected Products

Jenkins

Jenkins Yaml Axis Plugin

References · 7

• https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1825 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-324h-2v7h-q3xx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2179 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2179 · Security Note
• https://github.com/jenkinsci/yaml-axis-plugin · Note
• https://github.com/jenkinsci/yaml-axis-plugin/commit/346802860c68a5a9bb4996c81fed4e05bee594f4 · Note
• http://openwall.com/lists/oss-security/2020/04/16/4 · Note