PT-2020-2659 · Jenkins · Jenkins Openshift Pipeline Plugin+1

Daniel Kalinowski · CVE-2020-2167 · Published 2020-03-25 · Updated 2023-10-25

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins OpenShift Pipeline Plugin versions 1.0.56 and earlier

Description The issue is related to the YAML parser in the Jenkins OpenShift Pipeline Plugin, which does not prevent the instantiation of arbitrary types. This results in a remote code execution vulnerability. The vulnerability can be exploited by users who can provide YAML input files to the plugin's build step, allowing them to execute arbitrary code remotely. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For Jenkins OpenShift Pipeline Plugin versions 1.0.56 and earlier, update to version 1.0.57 or later, which configures its YAML parser to only instantiate safe types. As a temporary workaround, consider restricting access to the build step that uses the YAML parser to minimize the risk of exploitation.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

BDU:2020-02703

CVE-2020-2167

GHSA-264W-XRR7-6QQG

RHSA-2020:0964

Affected Products

Jenkins

Jenkins Openshift Pipeline Plugin

References · 9

• https://osv.dev/vulnerability/GHSA-264w-xrr7-6qqg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2167 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02703 · Security Note
• https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1739 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2167 · Security Note
• https://github.com/jenkinsci/openshift-pipeline-plugin · Note
• http://openwall.com/lists/oss-security/2020/03/25/2 · Note
• https://t.me/cvenotify/2142 · Telegram Post
• https://openwall.com/lists/oss-security/2020/03/25/2 · Note