Description
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/10/01/2
https://access.redhat.com/errata/RHSA-2019:4055
https://access.redhat.com/errata/RHSA-2019:4089
https://access.redhat.com/errata/RHSA-2019:4097
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1579
Related Vulnerabilities
CVE-2016-5019 Vulnerability in maven package org.apache.myfaces.trinidad:trinidad-impl
CVE-2020-14060 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2021-21118 Vulnerability in npm package electron
CVE-2019-10241 Vulnerability in maven package org.eclipse.jetty.aggregate:jetty-all-server
CVE-2020-9483 Vulnerability in maven package org.apache.skywalking:server-storage-plugin