CVE-2020-2167: RCE vulnerability in Jenkins OpenShift Pipeline Plugin
Summary
CVE-2020-2167: RCE vulnerability in Jenkins OpenShift Pipeline Plugin. Affects com.openshift.jenkins:openshift-pipeline versions < 1.0.57. Fixed in 1.0.57. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The OpenShift Pipeline Plugin is a Maven package that provides functionality for integrating Jenkins with OpenShift. It allows users to define and execute pipelines as code, automating the build, test, and deployment processes. The plugin is widely used in DevOps environments to streamline CI/CD workflows.
Vulnerability Detail
OpenShift Pipeline Plugin versions 1.0.56 and earlier are vulnerable to a remote code execution (RCE) exploit. The plugin's YAML parser is not properly configured to prevent the instantiation of arbitrary types, allowing an attacker to execute malicious code remotely. This vulnerability can be exploited by users who can provide YAML input files to the plugin's build step. OpenShift Pipeline Plugin version 1.0.57 addresses this issue by configuring the YAML parser to only instantiate safe types.
How To Fix
Minimum fixed version
1.0.57
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the OpenShift Pipeline Plugin to mitigate the risk of remote code execution.
Conclusion
The RCE vulnerability in Jenkins OpenShift Pipeline Plugin (CVE-2020-2167) poses a significant risk to systems using affected versions of the plugin. It is crucial to upgrade to version 1.0.57 or later to mitigate the risk of remote code execution. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.openshift.jenkins:openshift-pipeline →
FAQ
This vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to unauthorized access, data breaches, or disruption of services.
Users of OpenShift Pipeline Plugin versions 1.0.56 and earlier are affected by this vulnerability. It is recommended for all users of the plugin to upgrade to the fixed version.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is crucial to apply the fix promptly to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely. Attackers can provide malicious YAML input files to the OpenShift Pipeline Plugin's build step, allowing them to execute arbitrary code on the affected system.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for com.openshift.jenkins:openshift-pipeline.
