GitHub Advisoryadvisory · Maven

GHSA-58pr-hprx-7hg6 RCE vulnerability in Jenkins Code Coverage API Plugin

HIGH Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2021-21677
Ecosystem
Maven
Packages
io.jenkins.plugins:code-coverage-api
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-12-15

Affected packages

• Maven io.jenkins.plugins:code-coverage-api: < 1.4.1 → fixed in 1.4.1

Description

Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply JEP-200 deserialization protection to Java objects it deserializes from disk. This results in a remote code execution (RCE) vulnerability exploitable by attackers able to control agent processes. Jenkins Code Coverage API Plugin 1.4.1 configures its Java object deserialization to only deserialize safe types.

Related

Alias · CVE (1)

  • CVE-2021-21677 Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References