PT-2020-15403 · Jenkins · Jenkins Scm Filter Jervis Plugin+1

Published 2020-05-06 · Updated 2023-10-25 · CVE-2020-2189

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins SCM Filter Jervis Plugin versions 0.2.1 and earlier

Description The issue results from the YAML parser not being configured to prevent the instantiation of arbitrary types, leading to a remote code execution vulnerability. This vulnerability is exploitable by users who can configure jobs with the filter or control the contents of a previously configured job's SCM repository.

Recommendations For Jenkins SCM Filter Jervis Plugin versions 0.2.1 and earlier, update to version 0.3 or later, which configures its YAML parser to only instantiate safe types.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-2189

GHSA-4HHQ-J3XW-WJ89

Affected Products

Jenkins

Jenkins Scm Filter Jervis Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2020-2189 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hhq-j3xw-wj89 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2189 · Security Note
• https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1826 · Vendor Advisory
• https://github.com/jenkinsci/scm-filter-jervis-plugin/commit/a36e8bdef3a2a84737b64a898da4106793997273 · Note
• https://github.com/jenkinsci/scm-filter-jervis-plugin · Note
• http://openwall.com/lists/oss-security/2020/05/06/3 · Note