GHSA-3hvc-xwjp-xr8m

Liquibase Runner Plugin allows users to load arbitrary Java code into controller JVM

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000146

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:liquibase-runner	< 1.4.3	1.4.3

Details

As written in the advisory (Markdown source, shown as plain text).

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000146 advisory
https://github.com/jenkinsci/liquibase-runner-plugin/commit/1817af0b5bb17e690d89c0a1623de8bd47f8c1a1 web
https://github.com/jenkinsci/liquibase-runner-plugin/commit/382a1ea84910db28a88089306b24d1e80818f0a5 web
https://github.com/jenkinsci/liquibase-runner-plugin/commit/7726ce4569a287e32fbda6f01ad2846ada909436 web
https://github.com/jenkinsci/liquibase-runner-plugin web
https://jenkins.io/security/advisory/2018-03-26/#SECURITY-519 web