Red Hat Security Advisory: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update

Fixed packages 1

Vulnerabilities 6

• Critical 9.9
  CVE-2019-1003029 Exploited Public exploit EPSS 74%

  Sandbox bypass in Script Security Plugin

  A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScr…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Mar 8, 2019

  KEV Apr 25, 2022
• Critical 9.9
  CVE-2019-1003030 Exploited Public exploit Scanner template EPSS 97%

  Sandbox bypass in Jenkins Pipeline: Groovy Plugin

  A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the …

  Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
  Mar 8, 2019

  KEV Mar 25, 2022
• Critical 9.9
  CVE-2019-1003031

  Script security sandbox bypass in Matrix Project Plugin

  A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

  Jenkins Project Jenkins Matrix Project Plugin org.jenkins-ci.plugins:matrix-project Web / CMS Maven
  Mar 8, 2019
• Critical 9.9
  CVE-2019-1003034

  Script security sandbox bypass in Jenkins Job DSL Plugin

  A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhi…

  Jenkins Project Jenkins Job DSL Plugin org.jenkins-ci.plugins:job-dsl Web / CMS Maven
  Mar 8, 2019
• High 8.8
  CVE-2019-1003005 Public exploit EPSS 20%

  Sandbox Bypass in Script Security Plugin

  A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Feb 6, 2019
• High 8.8
  CVE-2019-1003024

  Jenkins Script Security Plugin sandbox bypass vulnerability

  A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code …

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Feb 20, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1670283
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1684556
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1689873
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1689886
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690663
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690665
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0739.json
• report
  https://access.redhat.com/security/cve/CVE-2019-1003005
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1003005
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1003005
• article
  https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292
• report
  https://access.redhat.com/security/cve/CVE-2019-1003024
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1003024
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1003024
• article
  https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1320
• report
  https://access.redhat.com/security/cve/CVE-2019-1003029
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1003029
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1003029
• article
  https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2019-1003030
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1003030
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1003030
• article
  https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(2)
• report
  https://access.redhat.com/security/cve/CVE-2019-1003031
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1003031
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1003031
• article
  https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1339
• report
  https://access.redhat.com/security/cve/CVE-2019-1003034
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1003034
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1003034
• article
  https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1342