GHSA-9r3h-wm3x-v245
RCE vulnerability in ElasticBox Jenkins Kubernetes CI/CD Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.elasticbox.jenkins-ci.plugins:kubernetes-ci | <= 1.3 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to ElasticBox Jenkins Kubernetes CI/CD Plugin’s build step.
References
External links from the advisory. They lead to third-party sites.