GHSA-c329-r874-xc7j

Remote Code Execution vulnerability in Jenkins Literate Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2020-2158

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:literate	<= 1.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2158 advisory
https://github.com/jenkinsci/literate-plugin package
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1750 web
http://www.openwall.com/lists/oss-security/2020/03/09/1 web