GitHub Advisoryadvisory · Maven

GHSA-qrm8-cw73-r9w8 RCE vulnerability in Jenkins AWS SAM Plugin

HIGH Published 2022-05-24 Modified 2023-12-06 Official page ↗
Aliases
CVE-2020-2180
Ecosystem
Maven
Packages
io.jenkins.plugins:aws-sam
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-12-16

Affected packages

• Maven io.jenkins.plugins:aws-sam: < 1.2.3 → fixed in 1.2.3

Description

AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to configure a job or control the contents of a previously configured \"AWS SAM deploy application\" build step’s YAML SAM template file (`template.yaml` or equivalent) file. AWS SAM Plugin 1.2.3 configures its YAML parser to only instantiate safe types.

Related

Alias · CVE (1)

  • CVE-2020-2180 Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References