CVE-2020-2121: RCE vulnerability in Google Kubernetes Engine Plugin
Summary
CVE-2020-2121: RCE vulnerability in Google Kubernetes Engine Plugin. Affects org.jenkins-ci.plugins:google-kubernetes-engine versions < 0.8.1. Fixed in 0.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Google Kubernetes Engine Plugin is a Maven package that provides integration between Jenkins and Google Kubernetes Engine (GKE). It allows users to build, deploy, and manage applications on GKE directly from Jenkins. The plugin facilitates the automation of containerized application deployment and scaling on GKE clusters.
Vulnerability Detail
The Google Kubernetes Engine Plugin version 0.8.0 and earlier is susceptible to a remote code execution (RCE) vulnerability. The plugin's YAML parser is not properly configured to prevent the instantiation of arbitrary types. This flaw enables users with the ability to provide YAML input files to the plugin's build step to execute arbitrary code remotely. The vulnerability has a CVSS score of 8.8, indicating a high severity level. The issue was addressed in version 0.8.1, which configures the YAML parser to only instantiate safe types.
How To Fix
Minimum fixed version
0.8.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the Google Kubernetes Engine Plugin as soon as possible.
Conclusion
The RCE vulnerability in the Google Kubernetes Engine Plugin poses a significant risk to users, as it allows remote code execution. It is crucial to upgrade to version 0.8.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:google-kubernetes-engine →
FAQ
The vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to unauthorized access, data breaches, or disruption of services.
Users of Google Kubernetes Engine Plugin versions 0.8.0 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory.
Yes, this vulnerability has been assigned the CVE identifier CVE-2020-2121.
Yes, you can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:google-kubernetes-engine.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
