Description
Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/03/25/2
https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1741
Related Vulnerabilities
CVE-2020-17523 Vulnerability in maven package org.apache.shiro:shiro-web
CVE-2022-23302 Vulnerability in maven package log4j:log4j
CVE-2022-43441 Vulnerability in npm package sqlite3
CVE-2020-7690 Vulnerability in npm package jspdf
CVE-2023-40809 Vulnerability in maven package org.opencrx:opencrx-core-models