Description
Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/03/25/2
https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1739
Related Vulnerabilities
CVE-2022-35144 Vulnerability in npm package raneto
CVE-2023-27095 Vulnerability in maven package cn.hippo4j:hippo4j-core
CVE-2020-7663 Vulnerability in npm package websocket-extensions
CVE-2022-1233 Vulnerability in npm package urijs
CVE-2022-45347 Vulnerability in maven package org.apache.shardingsphere:shardingsphere-proxy