PT-2020-2660 · Jenkins · Jenkins Azure Container Service Plugin+1

Daniel Kalinowski · Published 2020-03-25 · Updated 2023-10-25 · CVE-2020-2168

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins Azure Container Service Plugin versions 1.0.1 and earlier

Description The issue is related to the YAML parser in the Jenkins Azure Container Service Plugin, which does not properly configure to prevent the instantiation of arbitrary types. This results in a remote code execution vulnerability. The vulnerability can be exploited by users who can provide YAML input files to the plugin's build step, allowing a remote attacker to execute arbitrary code.

Recommendations For Jenkins Azure Container Service Plugin versions 1.0.1 and earlier, update to version 1.0.2 or later, which configures its YAML parser to only instantiate safe types. As a temporary workaround, consider restricting access to the build step that uses the YAML parser to minimize the risk of exploitation.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

BDU:2020-02704

CVE-2020-2168

GHSA-5QFF-7944-VQ4F

Affected Products

Jenkins

Jenkins Azure Container Service Plugin

References · 9

• https://osv.dev/vulnerability/CVE-2020-2168 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2168 · Security Note
• https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1732 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02704 · Security Note
• https://osv.dev/vulnerability/GHSA-5qff-7944-vq4f · Vendor Advisory
• https://github.com/jenkinsci/azure-acs-plugin · Note
• https://t.me/cvenotify/2143 · Telegram Post
• http://openwall.com/lists/oss-security/2020/03/25/2 · Note
• https://openwall.com/lists/oss-security/2020/03/25/2 · Note