org.jenkins-ci.plugins.workflow:workflow-aggregator (0.1-beta-8), org.jenkins-ci.plugins.workflow:workflow-cps (0.1-beta-8) +2 more potentially affected by CVE-2018-1000058 via org.jenkins-ci.plugins.workflow:workflow-support (0.1-beta-8)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version 0.1-beta-8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-support and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

org.jenkins-ci.plugins.workflow:workflow-aggregator (0.1-beta-5), org.jenkins-ci.plugins.workflow:workflow-cps (0.1-beta-5) +2 more potentially affected by CVE-2018-1000058 via org.jenkins-ci.plugins.workflow:workflow-support (0.1-beta-5)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version 0.1-beta-5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-support and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.6-alpha-1), org.jenkins-ci.plugins.workflow:workflow-cps (1.6-alpha-1) +2 more potentially affected by CVE-2018-1000058 via org.jenkins-ci.plugins.workflow:workflow-support (1.6-alpha-1)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version 1.6-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-support and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

com.synopsys.jenkinsci:ownership (>=0.9.0-beta-1, <=0.13.0), hudson.plugins.sloccount:sloccount (>=1.22, <=1.25) +14 more potentially affected by CVE-2018-1000058 via org.jenkins-ci.plugins.workflow:workflow-support (1.14)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version 1.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-support and may be impacted: - com.synopsys.jenkinsci:ownership =0.9.0-beta-1, =1.22, =2.2, =1....

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.13) +10 more potentially affected by CVE-2018-1000058 via org.jenkins-ci.plugins.workflow:workflow-support (1.13)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-support and may be impacted: - com.btc.ep:btc-embeddedplatform =1.9.2-beta, =2.0, =1.4, =1.12.1...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.4.3-beta-1), org.jenkins-ci.plugins.workflow:workflow-cps (1.4.3-beta-1) +2 more potentially affected by CVE-2018-1000058 via org.jenkins-ci.plugins.workflow:workflow-support (1.4.3-beta-1)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version 1.4.3-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-support and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

CVE-2018-1000058

CVE-2018-1000058 affects Jenkins Pipeline: Supporting APIs Plugin up to version 2.17. Root cause: incomplete sandbox protection allowing deserialization via readResolve in Pipeline scripts, enabling arbitrary code execution. Impact: remote code execution with network access; high severity per lin...

CVE-2018-1000058

Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deserialization like readResolve implemented in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary...