GHSA-f46p-q6jh-226m

Incorrect Authorization in Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10418

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.fabric8.pipeline:kubernetes-pipeline-arquillian-steps	<= 1.6	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10418 advisory
https://github.com/jenkinsci/kubernetes-pipeline-plugin/blob/master/arquillian-steps package
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-920%20(2) web
http://www.openwall.com/lists/oss-security/2019/09/25/3 web