https://bugzilla.redhat.com/show_bug.cgi?id=1694532
Bug ID: 1694532
Summary: CVE-2019-1003040 jenkins-plugin-script-security:
Sandbox bypass in Script Security Plugin and Pipeline:
Groovy Plugin (SECURITY-1353)
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=important,public=20190325,reported=20190326,sou
rce=internet,cvss3=8.8/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:
U/C:H/I:H/A:H,cwe=CWE-704,fedora-all/jenkins-script-se
curity-plugin=affected,openshift-enterprise-3.4/jenkin
s-plugin-script-security=new,openshift-enterprise-3.5/
jenkins-plugin-script-security=new,openshift-enterpris
e-3.6/jenkins-plugin-script-security=new,openshift-ent
erprise-3.7/jenkins-plugin-script-security=new,openshi
ft-enterprise-3.9/jenkins-plugin-script-security=new,o
penshift-enterprise-3.10/jenkins-plugin-script-securit
y=new,openshift-enterprise-3.11/jenkins-2-plugins=new,
openshift-enterprise-4.1/jenkins-2-plugins=new
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, eparis(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com,
obulatov(a)redhat.com, wzheng(a)redhat.com
Target Milestone: ---
Classification: Other
Sandbox projection in the Jenkins Script Security and Pipeline: Groovy Plugins
could be circumvented through methods supporting type casts and type coercion.
This allowed attackers to invoke constructors for arbitrary types.
External Reference:
https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1353
--
You are receiving this mail because:
You are on the CC list for the bug.