Remote code execution

Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Remote code execution

Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Remote code execution

Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2166

CVE-2020-2166 affects Jenkins Pipeline: AWS Steps Plugin versions 1.40 and earlier. The root cause is that the YAML parser is not restricted, allowing instantiation of arbitrary types and enabling remote code execution. The vulnerability is described across multiple sources as RCE via YAML input ...

CVE-2020-2168

Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2167

Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2167

CVE-2020-2167 affects the Jenkins OpenShift Pipeline Plugin, with versions 1.0.56 and earlier vulnerable. The root cause is the YAML parser not restricting deserialization of arbitrary types, enabling remote code execution when a user provides YAML input to the plugin’s build step. Public records...

CVE-2020-2168

CVE-2020-2168 affects the Jenkins Azure Container Service Plugin for Jenkins, with versions 1.0.1 and earlier. The root cause is that the plugin’s YAML parser does not restrict deserialization, allowing arbitrary types to be instantiated, which enables remote code execution (RCE). Impact is high ...

PT-2020-15378 · Jenkins · Jenkins Pipeline: Aws Steps Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: AWS Steps Plugin versions 1.40 and earlier Description: The issue is related to the configuration of the YAML parser in the Jenkins Pipeline: AWS Steps Plugin, which does not prevent the instantiation of arbitrary types. Thi...

PT-2020-2660 · Jenkins · Jenkins Azure Container Service Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Azure Container Service Plugin versions 1.0.1 and earlier Description: The issue is related to the YAML parser in the Jenkins Azure Container Service Plugin, which does not properly configure to prevent the instantiation of arbitrary...

CloudBees Jenkins Literate Code Issue Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . Literate is used in one of the document build...

PyYAML: Arbitrary code execution

Background PyYAML is a YAML parser and emitter for Python. Description It was found that using yaml.load API on untrusted input could lead to arbitrary code execution. Impact A remote attacker could entice a user to process specially crafted input in an application using yaml.load from PyYAML,...

CVE-2020-2158

Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2158

Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Remote code execution

Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2158

The CVE-2020-2158 entry affects Jenkins Literate Plugin versions 1.0 and earlier. The root cause is that the YAML parser is not configured to prevent instantiation of arbitrary types, enabling remote code execution. The impact is remote code execution with the plugin, and multiple sources identif...

CVE-2020-2158

Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

PyYAML Input Validation Error Vulnerability

PyYAML is a Python based YAML parser and generator . There is an input validation error vulnerability in PyYAML, when the user loads a yaml file that the program does not trust through the fullload method or Fullloader method, it is easy to cause arbitrary code execution vulnerability, which can ...

[SECURITY] Fedora 30 Update: PyYAML-5.3-2.fc30

YAML is a data serialization format designed for human readability and interaction with scripting languages. PyYAML is a YAML parser and emitter for Python. PyYAML features a complete YAML 1.1 parser, Unicode support, pickle support, capable extension API, and sensible error messages. PyYAML...

[SECURITY] Fedora 31 Update: PyYAML-5.3-2.fc31

YAML is a data serialization format designed for human readability and interaction with scripting languages. PyYAML is a YAML parser and emitter for Python. PyYAML features a complete YAML 1.1 parser, Unicode support, pickle support, capable extension API, and sensible error messages. PyYAML...