high8.8
CVE-2020-2166
RCE vulnerability in Jenkins Pipeline: AWS Steps Plugin
Impact
Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to Pipeline: AWS Steps Plugin’s build steps. Pipeline: AWS Steps Plugin 1.41 configures its YAML parser to only instantiate safe types.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | de.taimos:pipeline-aws | < 1.41 | 1.41 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Pipeline\ | through 1.40 |