https://bugzilla.redhat.com/show_bug.cgi?id=1764390
Bug ID: 1764390
Summary: CVE-2019-10431 jenkins-script-security: Sandbox bypass
vulnerability in Script Security Plugin
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: abenaiss(a)redhat.com, bmontgom(a)redhat.com,
eparis(a)redhat.com, extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, sponnaga(a)redhat.com,
vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
Sandbox protection in Script Security Plugin could be circumvented through
default parameter expressions in constructors. This allowed attackers able to
specify and run sandboxed scripts to execute arbitrary code in the context of
the Jenkins master JVM.
References:
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1579
--
You are receiving this mail because:
You are on the CC list for the bug.