chore(deps): update dependency org.jenkins-ci.plugins:pipeline-utility-steps to v2 [security] #5023
+1
−1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
44ea2c9 to
d756843
Compare
67ba457 to
099ab8e
Compare
0d577a0 to
a88fdf9
Compare
8f33e8c to
d533fcd
Compare
5150feb to
f13deef
Compare
f74fb98 to
476adb0
Compare
e5b903f to
6b0c3af
Compare
cc32e12 to
72932c3
Compare
72932c3 to
b9ae0ed
Compare
|
/it-go |
b9ae0ed to
5633210
Compare
|
/it-go |
5633210 to
686a1d2
Compare
|
/it-go |
686a1d2 to
53ec9f5
Compare
|
/it-go |
53ec9f5 to
128e33a
Compare
|
/it-go |
…y-steps to v2 [security]
128e33a to
9da778e
Compare
|
/it-go |
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.3.0->2.15.3GitHub Vulnerability Alerts
CVE-2022-45381
Pipeline Utility Steps Plugin implements a
readPropertiesPipeline step that supports interpolation of variables using the Apache Commons Configuration library.Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of this library that enable the
file:prefix interpolator by default.This allows attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.
Pipeline Utility Steps Plugin 2.13.2 restricts the set of prefix interpolators enabled by default to
base64Decoder:,base64Encoder:,date:,urlDecoder:, andurlEncoder:.Administrators can set the Java system property
org.jenkinsci.plugins.pipeline.utility.steps.conf.ReadPropertiesStepExecution.CUSTOM_PREFIX_INTERPOLATOR_LOOKUPSto customize which prefix interpolators are enabled.CVE-2023-32981
Jenkins Pipeline Utility Steps Plugin provides the
untarandunzipPipeline steps to extract archives into job workspaces.Pipeline Utility Steps Plugin 2.15.2 and earlier does not validate or limit file paths of files contained within these archives.
This allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.
Pipeline Utility Steps Plugin 2.15.3 rejects extraction of files in
tarandziparchives that would be placed outside the expected destination directory.Release Notes
jenkinsci/pipeline-utility-steps-plugin (org.jenkins-ci.plugins:pipeline-utility-steps)
v2.3.1Enabled release Drafter.
v2.3.0v2.2.0Minor bumped because bump of Jenkins core dependency.
v2.1.0v2.0.2v2.0.1teestep. (PR #43)v2.0Minor bumped because bump of Jenkins core dependency.
v1.5.1prettyparameter towriteJSONstep (PR #33).v1.5.0sha1(PR #32).v1.4.1readXxmethods not require a workspace if only thetextparameter is used (PR #31).v1.4.0writeYamlstep (PR #23)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.