https://bugzilla.redhat.com/show_bug.cgi?id=1443409
Bug ID: 1443409
Summary: jenkins-task-reactor: Running arbitrary Groovy code in
Jenskin JVM via Reactor Event (SECURITY-487)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com
Reactor plugin allows users with Job/Configure permission to run arbitrary
Groovy code inside the Jenkins JVM by defining a Reactor Script that will be
run when a Reactor Event triggers, effectively elevating privileges to
Overall/Run Scripts.
Affects all versions.
--
You are receiving this mail because:
You are on the CC list for the bug.