CVE-2020-2189

CVE-2020-2189 concerns Jenkins SCM Filter Jervis Plugin. The vulnerability stems from the YAML parser not being configured to prevent arbitrary type instantiation in version 0.2.1 and earlier, allowing remote code execution when a user configures a job with the filter or controls a previously con...

CVE-2020-2189

Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

PT-2020-15403 · Jenkins · Jenkins Scm Filter Jervis Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SCM Filter Jervis Plugin versions 0.2.1 and earlier Description: The issue results from the YAML parser not being configured to prevent the instantiation of arbitrary types, leading to a remote code execution vulnerability. This...

CVE-2020-2189: Deserialization of Untrusted Data

Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

[SECURITY] Fedora 31 Update: snakeyaml-1.26-1.fc31

SnakeYAML features: a complete YAML 1.1 parser. In particular, SnakeYAML can parse all examples from the specification. Unicode support including UTF-8/UTF-16 input/output. high-level API for serializing and deserializing native Java objects. support for all types from the YAML types repository...

[SECURITY] Fedora 32 Update: snakeyaml-1.26-1.fc32

SnakeYAML features: a complete YAML 1.1 parser. In particular, SnakeYAML can parse all examples from the specification. Unicode support including UTF-8/UTF-16 input/output. high-level API for serializing and deserializing native Java objects. support for all types from the YAML types repository...

Remote Code Execution

apache heron is vulnerable to remote code execution. The YAML parser is not configured by default to prevent the instantiation of arbitrary types, resulting in remote code execution vulnerabilities...

CVE-2020-1964

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities CWE-502: Deserialization of Untrusted Data...

CVE-2020-1964

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities CWE-502: Deserialization of Untrusted Data...

CVE-2020-2180

Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2179

Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Remote code execution

Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Remote code execution

Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-1964

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities CWE-502: Deserialization of Untrusted Data...

CVE-2020-1964

CVE-2020-1964 affects Apache Heron 0.20.2-incubating, 0.20.1-incubating, and v-0.20.0-incubating. The root cause is the YAML parser not configured to prevent instantiation of arbitrary types, leading to remote code execution (CWE-502: Deserialization of Untrusted Data). Public references in multi...

CVE-2020-2180

Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2180

CVE-2020-2180 affects Jenkins AWS SAM Plugin (versions 1.2.2 and earlier). The root cause is that the YAML parser did not restrict deserialization of arbitrary types, enabling remote code execution. Exploitation is feasible by a user who can configure a job or control the YAML template in an AWS ...

CVE-2020-2180: Deserialization of Untrusted Data

Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-1964: Deserialization of Untrusted Data

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities CWE-502: Deserialization of Untrusted Data...

RCE vulnerability in yaml-axis

yaml-axis 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution RCE vulnerability exploitable by users able to configure a multi-configuration Matrix job, or control the contents of a previously configured job...