CVE-2020-2121

Name of the Vulnerable Software and Affected Versions Jenkins Google Kubernetes Engine Plugin versions 0.8.0 and earlier

Description The issue is related to the configuration of the YAML parser in the Jenkins Google Kubernetes Engine Plugin, which does not prevent the instantiation of arbitrary types. This results in a remote code execution vulnerability that can be exploited by users who can provide YAML input files to the plugin's build step.

Recommendations For Jenkins Google Kubernetes Engine Plugin versions 0.8.0 and earlier, update to version 0.8.1 or later, which configures its YAML parser to only instantiate safe types.