Incorrect Authorization in Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin

2022-05-2416:56:46

Google

osv.dev

0.001 Low

EPSS

Percentile

42.9%

JSON

Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.

CPENameOperatorVersion
io.fabric8.pipeline:kubernetes-pipeline-arquillian-stepseq1.5
io.fabric8.pipeline:kubernetes-pipeline-arquillian-stepseq1.6

CPE	Name	Operator	Version
	io.fabric8.pipeline:kubernetes-pipeline-arquillian-steps	eq	1.5
	io.fabric8.pipeline:kubernetes-pipeline-arquillian-steps	eq	1.6

References

www.openwall.com/lists/oss-security/2019/09/25/3

github.com/jenkinsci/kubernetes-pipeline-plugin/blob/master/arquillian-steps

jenkins.io/security/advisory/2019-09-25/#SECURITY-920%20(2)

nvd.nist.gov/vuln/detail/CVE-2019-10418

0.001 Low

EPSS

Percentile

42.9%

JSON

Related for OSV:GHSA-F46P-Q6JH-226M