CVE-2020-2167

2020-03-2517:15:15

Google

osv.dev

7.6 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.9%

JSON

Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

CPENameOperatorVersion
openshift-pipeline-plugineqopenshift-pipeline-1.0.20
openshift-pipeline-plugineqopenshift-pipeline-1.0.11
openshift-pipeline-plugineqopenshift-pipeline-1.0.18
openshift-pipeline-plugineqopenshift-pipeline-1.0.14
openshift-pipeline-plugineqopenshift-pipeline-1.0.2
openshift-pipeline-plugineqopenshift-pipeline-1.0.5
openshift-pipeline-plugineqopenshift-pipeline-1.0.16
openshift-pipeline-plugineqopenshift-pipeline-1.0.50
openshift-pipeline-plugineqopenshift-pipeline-1.0.23
openshift-pipeline-plugineq1.0

Name	Operator	Version
openshift-pipeline-plugin	eq	openshift-pipeline-1.0.20
openshift-pipeline-plugin	eq	openshift-pipeline-1.0.11
openshift-pipeline-plugin	eq	openshift-pipeline-1.0.18
openshift-pipeline-plugin	eq	openshift-pipeline-1.0.14
openshift-pipeline-plugin	eq	openshift-pipeline-1.0.2
openshift-pipeline-plugin	eq	openshift-pipeline-1.0.5
openshift-pipeline-plugin	eq	openshift-pipeline-1.0.16
openshift-pipeline-plugin	eq	openshift-pipeline-1.0.50
openshift-pipeline-plugin	eq	openshift-pipeline-1.0.23
openshift-pipeline-plugin	eq	1.0