CVE-2020-2166: Input Validation
Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkins Pipeline: AWS Steps Pluginto a version that resolves this vulnerability.Fixed in 1.40 - Compensating control
Mitigate the Jenkins Pipeline: AWS Steps Plugin YAML deserialization remote code execution risk by preventing untrusted content from reaching the plugin’s YAML parsing/step inputs until the plugin is upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2166?
CVE-2020-2166 has a high severity due to its potential for remote code execution.
How do I fix CVE-2020-2166?
To fix CVE-2020-2166, upgrade the Jenkins Pipeline: AWS Steps Plugin to version 1.41 or later.
What versions of Jenkins Pipeline: AWS Steps are affected by CVE-2020-2166?
Versions up to and including 1.40 of Jenkins Pipeline: AWS Steps are affected by CVE-2020-2166.
What type of vulnerability is CVE-2020-2166?
CVE-2020-2166 is classified as a remote code execution vulnerability.
What can exploit CVE-2020-2166?
CVE-2020-2166 can be exploited by an attacker able to interact with the vulnerable Jenkins instance, potentially allowing them to execute arbitrary code.