Описание
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
Отчет
Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority — a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | jenkins | Affected | ||
| OpenShift Developer Tools and Services | jenkins-2-plugins | Affected | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-agent-base-rhel9 | Not affected | ||
| OpenShift Developer Tools and Services 4.12 | ocp-tools-4/jenkins-rhel8 | Fixed | RHSA-2026:60247 | 26.08.2026 |
| OpenShift Developer Tools and Services 4.13 | ocp-tools-4/jenkins-rhel8 | Fixed | RHSA-2026:60249 | 26.08.2026 |
| OpenShift Developer Tools and Services 4.14 | ocp-tools-4/jenkins-rhel8 | Fixed | RHSA-2026:60248 | 26.08.2026 |
| OpenShift Developer Tools and Services 4.15 | ocp-tools-4/jenkins-rhel8 | Fixed | RHSA-2026:60239 | 26.08.2026 |
| OpenShift Developer Tools and Services 4.16 | ocp-tools-4/jenkins-rhel9 | Fixed | RHSA-2026:60251 | 26.08.2026 |
| OpenShift Developer Tools and Services 4.17 | ocp-tools-4/jenkins-rhel9 | Fixed | RHSA-2026:60246 | 26.08.2026 |
| OpenShift Developer Tools and Services 4.18 | ocp-tools-4/jenkins-rhel9 | Fixed | RHSA-2026:60250 | 26.08.2026 |
Показывать по
Дополнительная информация
Статус:
8.8 High
CVSS3
Связанные уязвимости
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.
8.8 High
CVSS3