chore(deps): update dependency org.jenkins-ci.plugins:pipeline-utility-steps to v2 [security] #5023
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
3 times, most recently
from
44ea2c9
to
d756843
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
7 times, most recently
from
67ba457
to
099ab8e
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
7 times, most recently
from
0d577a0
to
a88fdf9
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
2 times, most recently
from
8f33e8c
to
d533fcd
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
8 times, most recently
from
5150feb
to
f13deef
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
2 times, most recently
from
f74fb98
to
476adb0
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
7 times, most recently
from
8159c00
to
4759636
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
9 times, most recently
from
700c7af
to
49e0bf2
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
8 times, most recently
from
2dadb76
to
cbe38e3
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
2 times, most recently
from
622f80b
to
4becbc8
Compare
…y-steps to v2 [security]
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
4becbc8
to
751372c
Compare
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.3.0->2.15.3GitHub Vulnerability Alerts
CVE-2022-45381
Pipeline Utility Steps Plugin implements a
readPropertiesPipeline step that supports interpolation of variables using the Apache Commons Configuration library.Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of this library that enable the
file:prefix interpolator by default.This allows attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.
Pipeline Utility Steps Plugin 2.13.2 restricts the set of prefix interpolators enabled by default to
base64Decoder:,base64Encoder:,date:,urlDecoder:, andurlEncoder:.Administrators can set the Java system property
org.jenkinsci.plugins.pipeline.utility.steps.conf.ReadPropertiesStepExecution.CUSTOM_PREFIX_INTERPOLATOR_LOOKUPSto customize which prefix interpolators are enabled.CVE-2023-32981
Jenkins Pipeline Utility Steps Plugin provides the
untarandunzipPipeline steps to extract archives into job workspaces.Pipeline Utility Steps Plugin 2.15.2 and earlier does not validate or limit file paths of files contained within these archives.
This allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.
Pipeline Utility Steps Plugin 2.15.3 rejects extraction of files in
tarandziparchives that would be placed outside the expected destination directory.Release Notes
jenkinsci/pipeline-utility-steps-plugin (org.jenkins-ci.plugins:pipeline-utility-steps)
v2.3.1Enabled release Drafter.
v2.3.0v2.2.0Minor bumped because bump of Jenkins core dependency.
v2.1.0v2.0.2v2.0.1teestep. (PR #43)v2.0Minor bumped because bump of Jenkins core dependency.
v1.5.1prettyparameter towriteJSONstep (PR #33).v1.5.0sha1(PR #32).v1.4.1readXxmethods not require a workspace if only thetextparameter is used (PR #31).v1.4.0writeYamlstep (PR #23)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.