Red Hat Bug Fix Advisory: OpenShift Container Platform 4.2 RPM Release Advisory

Fixed packages 1

Vulnerabilities 1

• Critical 9.9
  CVE-2019-10328

  Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin

  Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.

  Jenkins Project Jenkins Pipeline Remote Loader Plugin org.jenkins-ci.plugins:workflow-remote-loader Web / CMS Maven
  May 31, 2019

References

• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1741622
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_2921.json
• report
  https://access.redhat.com/security/cve/CVE-2019-10328
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1716794
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10328
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10328
• article
  https://jenkins.io/security/advisory/2019-05-31/#SECURITY-921