CVE-2018-1000058
High
Description
Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deserialization like readResolve implemented in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Jenkins Pipeline Supporting Apis
PublishedFeb 9, 2018
First seenFeb 9, 2018
How to fix
Update
- org.jenkins-ci.plugins.workflow:workflow-support2.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jenkins pipeline_supporting_apis | v ≤ 2.17 | — |
| org.jenkins-ci.plugins.workflow:workflow-supportMaven | v < 2.18 | 2.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.