Описание
A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed.
Меры по смягчению последствий
Do not run untrusted jenkins pipeline scripts.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 3.10 | jenkins-plugin-script-security | Affected | ||
| Red Hat OpenShift Container Platform 3.10 | jenkins-plugin-workflow-cps | Affected | ||
| Red Hat OpenShift Container Platform 3.11 | jenkins-plugin-script-security | Affected | ||
| Red Hat OpenShift Container Platform 3.2 | jenkins-plugin-script-security | Affected | ||
| Red Hat OpenShift Container Platform 3.2 | jenkins-plugin-workflow-cps | Affected | ||
| Red Hat OpenShift Container Platform 3.3 | jenkins-plugin-script-security | Affected | ||
| Red Hat OpenShift Container Platform 3.3 | jenkins-plugin-workflow-cps | Affected | ||
| Red Hat OpenShift Container Platform 3.4 | jenkins-plugin-script-security | Affected | ||
| Red Hat OpenShift Container Platform 3.4 | jenkins-plugin-workflow-cps | Affected | ||
| Red Hat OpenShift Container Platform 3.5 | jenkins-plugin-script-security | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed.
A sandbox bypass vulnerability exists in Script Security Plugin 1.47 a ...
EPSS
8.8 High
CVSS3