CVE-2020-2158: Remote Code Execution vulnerability in Jenkins Literate Plugin
Summary
CVE-2020-2158: Remote Code Execution vulnerability in Jenkins Literate Plugin. Affects org.jenkins-ci.plugins:literate versions < 1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Literate Plugin is a Maven-based plugin that allows users to write Jenkins pipeline scripts using a literate programming approach. It provides a way to define Jenkins pipeline steps and configurations in a human-readable format using YAML. This plugin is widely used by developers and administrators to automate build, test, and deployment processes in Jenkins.
Vulnerability Detail
The Jenkins Literate Plugin version 1.0 and earlier is vulnerable to remote code execution. The plugin does not properly configure its YAML parser, allowing the instantiation of arbitrary types. This vulnerability can be exploited by an attacker to execute arbitrary code on the Jenkins server, potentially leading to unauthorized access, data breaches, or further compromise of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading the Jenkins Literate Plugin to a non-vulnerable version.
Conclusion
The Jenkins Literate Plugin version 1.0 and earlier is vulnerable to remote code execution. It is crucial for users to upgrade their plugin installation to a non-vulnerable version to ensure the security of their Jenkins environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:literate →
FAQ
This vulnerability allows an attacker to execute arbitrary code on the Jenkins server, potentially leading to unauthorized access, data breaches, or further compromise of the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, and you can easily verify the vulnerability status of your application without any signup or installation.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is essential to apply the recommended fix as soon as possible to mitigate the risk.
Yes, a patch has been released to address this vulnerability. Users should upgrade their Jenkins Literate Plugin installation to a non-vulnerable version.
This vulnerability was discovered and reported by the GitHub Security Lab. The advisory was reviewed and published by GitHub on May 24, 2022.
