Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/07/31/1

https://access.redhat.com/errata/RHSA-2019:2651

https://access.redhat.com/errata/RHSA-2019:2594

https://access.redhat.com/errata/RHSA-2019:2662

https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20%281%29

Related Vulnerabilities

CVE-2021-21379 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-wikimacro-store

CVE-2019-16775 Vulnerability in maven package org.webjars.npm:npm

CVE-2021-21672 Vulnerability in maven package org.jenkins-ci.plugins:seleniumhtmlreport

CVE-2022-24719 Vulnerability in npm package fluture-node

CVE-2022-45401 Vulnerability in maven package org.jenkinsci.plugins:associated-files

Severity

Critical

Classification

CWE-704 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory