https://bugzilla.redhat.com/show_bug.cgi?id=1647059
Bug ID: 1647059
Summary: jenkins-plugin-script-security: Sandbox Bypass in
finalize methods
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: ahardin(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
eparis(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
The Groovy Sandbox library used by Script Security Plugin and Pipeline Groovy
Plugin did not apply sandbox restrictions to finalize methods. This could be
used to invoke arbitrary constructors and methods, bypassing sandbox
protection.
References:
https://jenkins.io/security/advisory/2018-10-29/
--
You are receiving this mail because:
You are on the CC list for the bug.