CVE-2020-1964

CVE-2020-1964 affects Apache Heron 0.20.2-incubating, 0.20.1-incubating, and v-0.20.0-incubating. The root cause is the YAML parser not configured to prevent instantiation of arbitrary types, leading to remote code execution (CWE-502: Deserialization of Untrusted Data). Public references in multi...

CVE-2020-1964

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities CWE-502: Deserialization of Untrusted Data...

CVE-2020-2180

Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2180

CVE-2020-2180 affects Jenkins AWS SAM Plugin (versions 1.2.2 and earlier). The root cause is that the YAML parser did not restrict deserialization of arbitrary types, enabling remote code execution. Exploitation is feasible by a user who can configure a job or control the YAML template in an AWS ...

[SECURITY] Fedora 32 Update: PyYAML-5.3.1-1.fc32

YAML is a data serialization format designed for human readability and interaction with scripting languages. PyYAML is a YAML parser and emitter for Python. PyYAML features a complete YAML 1.1 parser, Unicode support, pickle support, capable extension API, and sensible error messages. PyYAML...

Fedora: Security Advisory for PyYAML (FEDORA-2020-bdb0bfa928)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: PyYAML-5.3.1-1.fc30

YAML is a data serialization format designed for human readability and interaction with scripting languages. PyYAML is a YAML parser and emitter for Python. PyYAML features a complete YAML 1.1 parser, Unicode support, pickle support, capable extension API, and sensible error messages. PyYAML...

CVE-2020-2167

Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2168

Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2167

Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2167

Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Remote code execution

Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Remote code execution

Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Remote code execution

Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2166

CVE-2020-2166 affects Jenkins Pipeline: AWS Steps Plugin versions 1.40 and earlier. The root cause is that the YAML parser is not restricted, allowing instantiation of arbitrary types and enabling remote code execution. The vulnerability is described across multiple sources as RCE via YAML input ...

CVE-2020-2168

Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2167

Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2168

CVE-2020-2168 affects the Jenkins Azure Container Service Plugin for Jenkins, with versions 1.0.1 and earlier. The root cause is that the plugin’s YAML parser does not restrict deserialization, allowing arbitrary types to be instantiated, which enables remote code execution (RCE). Impact is high ...

CVE-2020-2167

CVE-2020-2167 affects the Jenkins OpenShift Pipeline Plugin, with versions 1.0.56 and earlier vulnerable. The root cause is the YAML parser not restricting deserialization of arbitrary types, enabling remote code execution when a user provides YAML input to the plugin’s build step. Public records...

PT-2020-15378 · Jenkins · Jenkins Pipeline: Aws Steps Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: AWS Steps Plugin versions 1.40 and earlier Description: The issue is related to the configuration of the YAML parser in the Jenkins Pipeline: AWS Steps Plugin, which does not prevent the instantiation of arbitrary types. Thi...