GHSA-p6qc-37hq-wqr6

Remote code execution vulnerability in Jenkins Templating Engine Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2021-21646

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:templating-engine	< 2.2	2.2

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin. This vulnerability allows attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. Jenkins Templating Engine Plugin 2.2 integrates with Script Security Plugin to protect its pipeline configurations.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-21646 advisory
https://github.com/jenkinsci/templating-engine-plugin/commit/aed14bed7333329f51330d0a8111e4d94cdee3e6 web
https://github.com/jenkinsci/templating-engine-plugin package
https://www.jenkins.io/security/advisory/2021-04-21/#SECURITY-2311 web
http://www.openwall.com/lists/oss-security/2021/04/21/2 web