CVE-2020-1731: 
Java vulnerability analysis and mitigation

A remote code execution (RCE) vulnerability was discovered in the Google Kubernetes Engine Plugin version 0.8.0 and earlier, identified as CVE-2020-2121 (SECURITY-1731). The vulnerability was disclosed on February 12, 2020, affecting the YAML parser configuration in the plugin which could allow arbitrary type instantiation (Jenkins Advisory).

The vulnerability stems from the Google Kubernetes Engine Plugin's YAML parser not being properly configured to prevent the instantiation of arbitrary types. The severity was rated as High according to the CVSS scoring system (Jenkins Advisory).

This vulnerability could allow attackers with the ability to provide YAML input files to Google Kubernetes Engine Plugin's build step to execute arbitrary code on the affected system (Jenkins Advisory).

The vulnerability is exploitable by users who have the ability to provide YAML input files to the Google Kubernetes Engine Plugin's build step (Jenkins Advisory).

The vulnerability was fixed in Google Kubernetes Engine Plugin version 0.8.1, which configures its YAML parser to only instantiate safe types. Users are advised to upgrade to this version or later to address the vulnerability (Jenkins Advisory).