https://bugzilla.redhat.com/show_bug.cgi?id=1689873
Bug ID: 1689873 Summary: CVE-2019-1003029 jenkins-plugin-script-security: sandbox bypass in script security plugin Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=important,public=20190306,reported=20190309,sou rce=cve,cvss3=8.8/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H /I:H/A:H,fedora-all/jenkins-script-security-plugin=aff ected,openshift-enterprise-3.11/jenkins-2-plugins=affe cted,openshift-enterprise-4.0/jenkins-2-plugins=affect ed,openshift-enterprise-3.4/jenkins-plugin-script-secu rity=affected,openshift-enterprise-3.5/jenkins-plugin- script-security=affected,openshift-enterprise-3.6/jenk ins-plugin-script-security=affected,openshift-enterpri se-3.7/jenkins-plugin-script-security=affected,openshi ft-enterprise-3.9/jenkins-plugin-script-security=affec ted,openshift-enterprise-3.10/jenkins-plugin-script-se curity=affected Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: darunesh@redhat.com CC: ahardin@redhat.com, bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, eparis@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jokerman@redhat.com, mchappel@redhat.com, mizdebsk@redhat.com, msrb@redhat.com Target Milestone: --- Classification: Other
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Reference: https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20
https://bugzilla.redhat.com/show_bug.cgi?id=1689873
Dhananjay Arunesh darunesh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1689874
--- Comment #1 from Dhananjay Arunesh darunesh@redhat.com --- Created jenkins-script-security-plugin tracking bugs for this issue:
Affects: fedora-all [bug 1689874]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1689874 [Bug 1689874] CVE-2019-1003029 jenkins-script-security-plugin: jenkins-plugin-script-security: sandbox bypass in script security plugin [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1689873
Dhananjay Arunesh darunesh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |jenkins-script-security-plu | |gin 1.54 Whiteboard|impact=important,public=201 |impact=important,public=201 |90306,reported=20190309,sou |90306,reported=20190309,sou |rce=cve,cvss3=8.8/CVSS:3.0/ |rce=cve,cvss3=8.8/CVSS:3.0/ |AV:N/AC:L/PR:L/UI:N/S:U/C:H |AV:N/AC:L/PR:L/UI:N/S:U/C:H |/I:H/A:H,fedora-all/jenkins |/I:H/A:H,cwe=CWE-96,fedora- |-script-security-plugin=aff |all/jenkins-script-security |ected,openshift-enterprise- |-plugin=affected,openshift- |3.11/jenkins-2-plugins=affe |enterprise-3.11/jenkins-2-p |cted,openshift-enterprise-4 |lugins=affected,openshift-e |.0/jenkins-2-plugins=affect |nterprise-4.0/jenkins-2-plu |ed,openshift-enterprise-3.4 |gins=affected,openshift-ent |/jenkins-plugin-script-secu |erprise-3.4/jenkins-plugin- |rity=affected,openshift-ent |script-security=affected,op |erprise-3.5/jenkins-plugin- |enshift-enterprise-3.5/jenk |script-security=affected,op |ins-plugin-script-security= |enshift-enterprise-3.6/jenk |affected,openshift-enterpri |ins-plugin-script-security= |se-3.6/jenkins-plugin-scrip |affected,openshift-enterpri |t-security=affected,openshi |se-3.7/jenkins-plugin-scrip |ft-enterprise-3.7/jenkins-p |t-security=affected,openshi |lugin-script-security=affec |ft-enterprise-3.9/jenkins-p |ted,openshift-enterprise-3. |lugin-script-security=affec |9/jenkins-plugin-script-sec |ted,openshift-enterprise-3. |urity=affected,openshift-en |10/jenkins-plugin-script-se |terprise-3.10/jenkins-plugi |curity=affected |n-script-security=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1689873
--- Comment #2 from Dhananjay Arunesh darunesh@redhat.com --- External References:
https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20
https://bugzilla.redhat.com/show_bug.cgi?id=1689873
Dhananjay Arunesh darunesh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1689895
https://bugzilla.redhat.com/show_bug.cgi?id=1689873
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90306,reported=20190309,sou |90306,reported=20190309,sou |rce=cve,cvss3=8.8/CVSS:3.0/ |rce=cve,cvss3=8.8/CVSS:3.0/ |AV:N/AC:L/PR:L/UI:N/S:U/C:H |AV:N/AC:L/PR:L/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-96,fedora- |/I:H/A:H,cwe=CWE-96,fedora- |all/jenkins-script-security |all/jenkins-script-security |-plugin=affected,openshift- |-plugin=affected,openshift- |enterprise-3.11/jenkins-2-p |enterprise-3.11/jenkins-2-p |lugins=affected,openshift-e |lugins=affected,openshift-e |nterprise-4.0/jenkins-2-plu |nterprise-4.0/jenkins-2-plu |gins=affected,openshift-ent |gins=affected,openshift-ent |erprise-3.4/jenkins-plugin- |erprise-3.4/jenkins-plugin- |script-security=affected,op |script-security=wontfix,ope |enshift-enterprise-3.5/jenk |nshift-enterprise-3.5/jenki |ins-plugin-script-security= |ns-plugin-script-security=w |affected,openshift-enterpri |ontfix,openshift-enterprise |se-3.6/jenkins-plugin-scrip |-3.6/jenkins-plugin-script- |t-security=affected,openshi |security=wontfix,openshift- |ft-enterprise-3.7/jenkins-p |enterprise-3.7/jenkins-2-pl |lugin-script-security=affec |ugins=wontfix,openshift-ent |ted,openshift-enterprise-3. |erprise-3.9/jenkins-2-plugi |9/jenkins-plugin-script-sec |ns=wontfix,openshift-enterp |urity=affected,openshift-en |rise-3.10/jenkins-2-plugs=w |terprise-3.10/jenkins-plugi |ontfix |n-script-security=affected |
https://bugzilla.redhat.com/show_bug.cgi?id=1689873
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90306,reported=20190309,sou |90306,reported=20190309,sou |rce=cve,cvss3=8.8/CVSS:3.0/ |rce=cve,cvss3=8.8/CVSS:3.0/ |AV:N/AC:L/PR:L/UI:N/S:U/C:H |AV:N/AC:L/PR:L/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-96,fedora- |/I:H/A:H,cwe=CWE-96,fedora- |all/jenkins-script-security |all/jenkins-script-security |-plugin=affected,openshift- |-plugin=affected,openshift- |enterprise-3.11/jenkins-2-p |enterprise-3.11/jenkins-2-p |lugins=affected,openshift-e |lugins=affected,openshift-e |nterprise-4.0/jenkins-2-plu |nterprise-4.0/jenkins-2-plu |gins=affected,openshift-ent |gins=affected,openshift-ent |erprise-3.4/jenkins-plugin- |erprise-3.4/jenkins-plugin- |script-security=wontfix,ope |script-security=wontfix,ope |nshift-enterprise-3.5/jenki |nshift-enterprise-3.5/jenki |ns-plugin-script-security=w |ns-plugin-script-security=w |ontfix,openshift-enterprise |ontfix,openshift-enterprise |-3.6/jenkins-plugin-script- |-3.6/jenkins-plugin-script- |security=wontfix,openshift- |security=wontfix,openshift- |enterprise-3.7/jenkins-2-pl |enterprise-3.7/jenkins-2-pl |ugins=wontfix,openshift-ent |ugins=wontfix,openshift-ent |erprise-3.9/jenkins-2-plugi |erprise-3.9/jenkins-2-plugi |ns=wontfix,openshift-enterp |ns=wontfix,openshift-enterp |rise-3.10/jenkins-2-plugs=w |rise-3.10/jenkins-2-plugins |ontfix |=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1689873
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90306,reported=20190309,sou |90306,reported=20190309,sou |rce=cve,cvss3=8.8/CVSS:3.0/ |rce=cve,cvss3=8.8/CVSS:3.0/ |AV:N/AC:L/PR:L/UI:N/S:U/C:H |AV:N/AC:L/PR:L/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-96,fedora- |/I:H/A:H,cwe=CWE-96,fedora- |all/jenkins-script-security |all/jenkins-script-security |-plugin=affected,openshift- |-plugin=affected,openshift- |enterprise-3.11/jenkins-2-p |enterprise-3.11/jenkins-2-p |lugins=affected,openshift-e |lugins=affected,openshift-e |nterprise-4.0/jenkins-2-plu |nterprise-4.0/jenkins-2-plu |gins=affected,openshift-ent |gins=affected,openshift-ent |erprise-3.4/jenkins-plugin- |erprise-3.4/jenkins-plugin- |script-security=wontfix,ope |script-security=wontfix,ope |nshift-enterprise-3.5/jenki |nshift-enterprise-3.5/jenki |ns-plugin-script-security=w |ns-plugin-script-security=w |ontfix,openshift-enterprise |ontfix,openshift-enterprise |-3.6/jenkins-plugin-script- |-3.6/jenkins-2-plugins=wont |security=wontfix,openshift- |fix,openshift-enterprise-3. |enterprise-3.7/jenkins-2-pl |7/jenkins-2-plugins=wontfix |ugins=wontfix,openshift-ent |,openshift-enterprise-3.9/j |erprise-3.9/jenkins-2-plugi |enkins-2-plugins=wontfix,op |ns=wontfix,openshift-enterp |enshift-enterprise-3.10/jen |rise-3.10/jenkins-2-plugins |kins-2-plugins=wontfix |=wontfix | Depends On| |1691961
https://bugzilla.redhat.com/show_bug.cgi?id=1689873
--- Comment #5 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 3.11
Via RHSA-2019:0739 https://access.redhat.com/errata/RHSA-2019:0739
https://bugzilla.redhat.com/show_bug.cgi?id=1689873
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Red Hat Product Errata | |RHSA-2019:0739
https://bugzilla.redhat.com/show_bug.cgi?id=1689873
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |aos-bugs@redhat.com, | |mmccomas@redhat.com, | |obulatov@redhat.com, | |wzheng@redhat.com Whiteboard|impact=important,public=201 |impact=important,public=201 |90306,reported=20190309,sou |90306,reported=20190309,sou |rce=cve,cvss3=8.8/CVSS:3.0/ |rce=cve,cvss3=8.8/CVSS:3.0/ |AV:N/AC:L/PR:L/UI:N/S:U/C:H |AV:N/AC:L/PR:L/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-96,fedora- |/I:H/A:H,cwe=CWE-96,fedora- |all/jenkins-script-security |all/jenkins-script-security |-plugin=affected,openshift- |-plugin=affected,openshift- |enterprise-3.11/jenkins-2-p |enterprise-3.11/jenkins-2-p |lugins=affected,openshift-e |lugins=affected,openshift-e |nterprise-4.0/jenkins-2-plu |nterprise-4.1/jenkins-2-plu |gins=affected,openshift-ent |gins=notaffected,openshift- |erprise-3.4/jenkins-plugin- |enterprise-3.4/jenkins-plug |script-security=wontfix,ope |in-script-security=wontfix, |nshift-enterprise-3.5/jenki |openshift-enterprise-3.5/je |ns-plugin-script-security=w |nkins-plugin-script-securit |ontfix,openshift-enterprise |y=wontfix,openshift-enterpr |-3.6/jenkins-2-plugins=wont |ise-3.6/jenkins-2-plugins=w |fix,openshift-enterprise-3. |ontfix,openshift-enterprise |7/jenkins-2-plugins=wontfix |-3.7/jenkins-2-plugins=wont |,openshift-enterprise-3.9/j |fix,openshift-enterprise-3. |enkins-2-plugins=wontfix,op |9/jenkins-2-plugins=wontfix |enshift-enterprise-3.10/jen |,openshift-enterprise-3.10/ |kins-2-plugins=wontfix |jenkins-2-plugins=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1689873 Bug 1689873 depends on bug 1689874, which changed state.
Bug 1689874 Summary: CVE-2019-1003029 jenkins-script-security-plugin: jenkins-plugin-script-security: sandbox bypass in script security plugin [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1689874
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
https://bugzilla.redhat.com/show_bug.cgi?id=1689873
--- Doc Text *updated* by Eric Christensen sparks@redhat.com --- A flaw was found in the Jenkins Script Security plugin version 1.53. An attacker with Overall/Read permissions is able to escape the sandbox and execute arbitrary code on the Jenkins master JVM. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
java-sig-commits@lists.fedoraproject.org