GHSA-ccxh-j7hg-m5mr

Incorrect Authorization in Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10417

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.fabric8.pipeline:kubernetes-pipeline-steps	<= 1.6	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10417 advisory
https://github.com/jenkinsci/kubernetes-pipeline-plugin/blob/master/kubernetes-steps package
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-920%20(1) web
http://www.openwall.com/lists/oss-security/2019/09/25/3 web