Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins-2-plugins security update

Fixed packages 2

Vulnerabilities 1

• High 8.8
  CVE-2020-2167

  RCE vulnerability in Jenkins OpenShift Pipeline Plugin

  Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

  Jenkins Project Jenkins OpenShift Pipeline Plugin com.openshift.jenkins:openshift-pipeline Web / CMS Maven
  Mar 25, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1816433
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0964.json
• report
  https://access.redhat.com/security/cve/CVE-2020-2167
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-2167
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-2167
• article
  https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1739