PT-2020-15393 · Jenkins · Jenkins Aws Sam Plugin+1

Published 2020-04-16 · Updated 2023-10-25 · CVE-2020-2180

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins AWS SAM Plugin versions 1.2.2 and earlier

Description The issue results from the YAML parser not being configured to prevent the instantiation of arbitrary types, leading to a remote code execution vulnerability. This vulnerability is exploitable by users who can configure a job or control the contents of a previously configured "AWS SAM deploy application" build step’s YAML SAM template file, such as template.yaml.

Recommendations For Jenkins AWS SAM Plugin versions 1.2.2 and earlier, update to version 1.2.3 or later, which configures its YAML parser to only instantiate safe types.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-2180

GHSA-QRM8-CW73-R9W8

Affected Products

Jenkins

Jenkins Aws Sam Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2180 · Security Note
• https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1736 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qrm8-cw73-r9w8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2180 · Vendor Advisory
• https://github.com/jenkinsci/aws-sam-plugin · Note
• https://github.com/jenkinsci/aws-sam-plugin/commit/6ddcb029638b5af05df701a11139d6a6c015ab7e · Note
• http://openwall.com/lists/oss-security/2020/04/16/4 · Note