Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.rundeck:rundeck-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8MavenPublished

    YAML deserialization can run untrusted code

    CVE-2021-39132 · GHSA-q4rf-3fhx-88pf

    Affected
    • Maven org.rundeck:rundeck-core >= 3.4.0, < 3.4.3; < 3.3.14
    Fixed in
    3.3.143.4.3· Vendor fix available
    Issue
    Impact An authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions: admin level access to the system resource type The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: create update or admin level access to a projectacl resource create update or admin level access to the systemacl resource The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches Versions 3.4.3,…

    Recommended action: Upgrade to 3.4.3 or 3.3.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.2MavenPublished

    Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server

    CVE-2021-39133 · GHSA-3jmw-c69h-426c

    Affected
    • Maven org.rundeck:rundeck-core >= 3.4.0, < 3.4.3; < 3.3.14
    Fixed in
    3.3.143.4.3· Vendor fix available
    Issue
    Impact A user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches Available in Rundeck 3.4.3 and 3.3.14 Workarounds Please visit https://rundeck.com/security for information about specific workarounds. For more information If you have any questions or comments about this advisory: Email us at security@rundeck.com To report security issues to Rundeck please use the form at https://rundeck.com/security

    Recommended action: Upgrade to 3.4.3 or 3.3.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →