CVE-2019-1003034

Опубликовано: 08 мар. 2019

Источник: nvd

CVSS3: 9.9

CVSS2: 6.5

EPSS Низкий

Описание

A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.

Ссылки

http://www.securityfocus.com/bid/107476
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:0739
Third Party Advisory
https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1342
Vendor Advisory
http://www.securityfocus.com/bid/107476
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:0739
Third Party Advisory
https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1342
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:job_dsl:*:*:*:*:*:jenkins:*:*

Версия до 1.71 (включая)

Конфигурация 2

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

EPSS

Процентиль: 82%

0.01809

Низкий

9.9 Critical

CVSS3

6.5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2019-1003034

CVSS3: 8.8

redhat

почти 7 лет назад

GHSA-5r74-pgmq-92mm

CVSS3: 9.9

github

больше 3 лет назад

Script security sandbox bypass in Jenkins Job DSL Plugin

BDU:2019-02073

CVSS3: 9.9

fstec

почти 7 лет назад

Уязвимость компонентов AbstractDslScriptLoader.groovy, JobDslWhitelist.groovy, SandboxDslScriptLoader.groovy плагина Jenkins Job DSL, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 82%

0.01809

Низкий

9.9 Critical

CVSS3

6.5 Medium

CVSS2

Дефекты

NVD-CWE-noinfo