chore(deps): update dependency org.jenkins-ci.plugins:pipeline-utility-steps to v2 [security] #5023
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
3 times, most recently
from
44ea2c9 to
d756843
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
7 times, most recently
from
67ba457 to
099ab8e
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
7 times, most recently
from
0d577a0 to
a88fdf9
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
2 times, most recently
from
8f33e8c to
d533fcd
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
8 times, most recently
from
5150feb to
f13deef
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
2 times, most recently
from
f74fb98 to
476adb0
Compare
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
f99bf05 to
dbc3e9e
Compare
|
/it-go |
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
dbc3e9e to
e094a33
Compare
|
/it-go |
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
e094a33 to
fa06e64
Compare
|
/it-go |
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
fa06e64 to
d0a582d
Compare
|
/it-go |
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
d0a582d to
ff33ab8
Compare
|
/it-go |
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
ff33ab8 to
4a69601
Compare
|
/it-go |
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
4a69601 to
5bf68eb
Compare
|
/it-go |
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
5bf68eb to
412e61d
Compare
|
/it-go |
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
412e61d to
6d9942c
Compare
|
/it-go |
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
6d9942c to
27c0cf6
Compare
|
/it-go |
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
27c0cf6 to
5eed434
Compare
|
/it-go |
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
5eed434 to
5702fea
Compare
|
/it-go |
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
5702fea to
56ca056
Compare
|
/it-go |
…y-steps to v2 [security]
renovate
bot
force-pushed
the
renovate/maven-org.jenkins-ci.plugins-pipeline-utility-steps-vulnerability
branch
from
56ca056 to
f5ce62f
Compare
|
/it-go |
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.3.0->2.15.3GitHub Vulnerability Alerts
CVE-2022-45381
Pipeline Utility Steps Plugin implements a
readPropertiesPipeline step that supports interpolation of variables using the Apache Commons Configuration library.Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of this library that enable the
file:prefix interpolator by default.This allows attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.
Pipeline Utility Steps Plugin 2.13.2 restricts the set of prefix interpolators enabled by default to
base64Decoder:,base64Encoder:,date:,urlDecoder:, andurlEncoder:.Administrators can set the Java system property
org.jenkinsci.plugins.pipeline.utility.steps.conf.ReadPropertiesStepExecution.CUSTOM_PREFIX_INTERPOLATOR_LOOKUPSto customize which prefix interpolators are enabled.CVE-2023-32981
Jenkins Pipeline Utility Steps Plugin provides the
untarandunzipPipeline steps to extract archives into job workspaces.Pipeline Utility Steps Plugin 2.15.2 and earlier does not validate or limit file paths of files contained within these archives.
This allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.
Pipeline Utility Steps Plugin 2.15.3 rejects extraction of files in
tarandziparchives that would be placed outside the expected destination directory.Release Notes
jenkinsci/pipeline-utility-steps-plugin (org.jenkins-ci.plugins:pipeline-utility-steps)
v2.3.1Enabled release Drafter.
v2.3.0v2.2.0Minor bumped because bump of Jenkins core dependency.
v2.1.0v2.0.2v2.0.1teestep. (PR #43)v2.0Minor bumped because bump of Jenkins core dependency.
v1.5.1prettyparameter towriteJSONstep (PR #33).v1.5.0sha1(PR #32).v1.4.1readXxmethods not require a workspace if only thetextparameter is used (PR #31).v1.4.0writeYamlstep (PR #23)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.