https://bugzilla.redhat.com/show_bug.cgi?id=1819652
Bug ID: 1819652
Summary: CVE-2019-16538 jenkins-script-security-plugin: sandbox
protection bypass leads to execute arbitrary code in
sandboxed scripts
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and
earlier related to the handling of default parameter expressions in closures
allowed attackers to execute arbitrary code in sandboxed scripts.
Reference:
http://www.openwall.com/lists/oss-security/2019/11/21/1
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Bug ID: 1819078
Summary: CVE-2020-2135 jenkins-2-plugins: sandbox protection
bypass leads to arbitrary code execution
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jenkins Script Security Plugin 1.70 and earlier,
where sandbox protection earlier could be circumvented through crafted method
calls on objects that implement GroovyInterceptable.
Reference:
http://www.openwall.com/lists/oss-security/2020/03/09/1
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1819093
Bug ID: 1819093
Summary: CVE-2020-2110 jenkins-2-plugins: sandbox protection
bypass during script compilation phase by applying AST
transforming annotations
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jenkins Script Security Plugin 1.69 and earlier,
where sandbox protection could be circumvented during the script compilation
phase by applying AST transforming annotations to imports or by using them
inside of other annotations.
Reference:
http://www.openwall.com/lists/oss-security/2020/02/12/3
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1819091
Bug ID: 1819091
Summary: CVE-2020-2134 jenkins-2-plugins: sandbox protection
bypass via crafted constructor calls and crafted
constructor bodies
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jenkins Script Security Plugin 1.70 and earlier,
where sandbox protection could be circumvented through crafted constructor
calls and crafted constructor bodies.
Reference:
http://www.openwall.com/lists/oss-security/2020/03/09/1
--
You are receiving this mail because:
You are on the CC list for the bug.