GHSA-58pr-hprx-7hg6

RCE vulnerability in Jenkins Code Coverage API Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2021-21677

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.jenkins.plugins:code-coverage-api	< 1.4.1	1.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply [JEP-200 deserialization protection](https://github.com/jenkinsci/jep/tree/master/jep/200) to Java objects it deserializes from disk. This results in a remote code execution (RCE) vulnerability exploitable by attackers able to control agent processes. Jenkins Code Coverage API Plugin 1.4.1 configures its Java object deserialization to only deserialize safe types.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-21677 advisory
https://github.com/jenkinsci/code-coverage-api-plugin/commit/a5b3c18cff2a0b494c55fa73b05fc935b50530be web
https://github.com/jenkinsci/code-coverage-api-plugin package
https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2376 web
http://www.openwall.com/lists/oss-security/2021/08/31/1 web