GHSA-w598-25hm-jqx3
RCE vulnerability in Jenkins Pipeline: AWS Steps Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | de.taimos:pipeline-aws | < 1.41 | 1.41 |
Details
As written in the advisory (Markdown source, shown as plain text).
Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to Pipeline: AWS Steps Plugin’s build steps.
Pipeline: AWS Steps Plugin 1.41 configures its YAML parser to only instantiate safe types.
References
External links from the advisory. They lead to third-party sites.