chore(deps): update dependency org.jenkins-ci.plugins:pipeline-utility-steps to v2 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.jenkins-ci.plugins:pipeline-utility-steps	1.3.0 -> 2.15.3

GitHub Vulnerability Alerts

CVE-2022-45381

Pipeline Utility Steps Plugin implements a readProperties Pipeline step that supports interpolation of variables using the Apache Commons Configuration library.

Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of this library that enable the file: prefix interpolator by default.

This allows attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.

Pipeline Utility Steps Plugin 2.13.2 restricts the set of prefix interpolators enabled by default to base64Decoder:, base64Encoder:, date:, urlDecoder:, and urlEncoder:.

Administrators can set the Java system property org.jenkinsci.plugins.pipeline.utility.steps.conf.ReadPropertiesStepExecution.CUSTOM_PREFIX_INTERPOLATOR_LOOKUPS to customize which prefix interpolators are enabled.

CVE-2023-32981

Jenkins Pipeline Utility Steps Plugin provides the untar and unzip Pipeline steps to extract archives into job workspaces.

Pipeline Utility Steps Plugin 2.15.2 and earlier does not validate or limit file paths of files contained within these archives.

This allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

Pipeline Utility Steps Plugin 2.15.3 rejects extraction of files in tar and zip archives that would be placed outside the expected destination directory.

---

Release Notes

jenkinsci/pipeline-utility-steps-plugin (org.jenkins-ci.plugins:pipeline-utility-steps)

v2.3.1

Enabled release Drafter.

v2.3.0

• JENKINS-54355,JENKINS-55759 Prepare for Java 11 (PR #​55, PR #​58, PR #​59, PR #​61, PR #​63)
• Add "excludes" option to skip over large directories (PR #​54)
• JENKINS-53053 - Implement pipeline steps for read / writing CSV files (PR #​53)

v2.2.0

Minor bumped because bump of Jenkins core dependency.

• Include defaults in interpolation (PR #​50)
• Updated maven-model version to workaround MNG-6204 (PR #​48)
• Just dev things
  • Dollar-slashy strings are not that safe (PR #​52)
  • [JEP-210] Verifying that the tee step works correctly with remote durable task output (PR #​51)

v2.1.0

• Fixed JENKINS-50633 requirering core bump to 2.73.2
• Added explicit charset encoding when reading json to match writing json

v2.0.2

• Workaround for JENKINS-50237 while Jenkins Core is not fixed/backported. (PR #​44)

v2.0.1

• Fixed the Snippetizer for tee step. (PR #​43)

v2.0

Minor bumped because bump of Jenkins core dependency.

• Include defaults in interpolation (PR #​50)
• Updated maven-model version to workaround MNG-6204 (PR #​48)
• Just dev things
  • Dollar-slashy strings are not that safe (PR #​52)
  • [JEP-210] Verifying that the tee step works correctly with remote durable task output (PR #​51)

v1.5.1

• JENKINS-47347 Added pretty parameter to writeJSON step (PR #​33).

v1.5.0

• Added step: sha1 (PR #​32).

v1.4.1

• Made the readXx methods not require a workspace if only the text parameter is used (PR #​31).

v1.4.0

• Implemented writeYaml step (PR #​23)
• JENKINS-43568 - : read/write steps locks files on windows agents, not properly closed (PR #​25, PR #​28, PR #​29, PR #​30)
• Improve the English in the touch step documentation (PR #​27)
• Add a Jenkinsfile (PR #​26)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[sonarcloud]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud