Red Hat Security Advisory: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update

Fixed packages 1

Vulnerabilities 3

• Critical 9.8
  CVE-2019-1003040

  Sandbox bypass vulnerability in Jenkins Script Security Plugin

  A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Mar 28, 2019
• Critical 9.8
  CVE-2019-1003041

  Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin

  A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

  Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
  Mar 28, 2019
• Medium 5.4
  CVE-2019-1003042

  Jenkins Lockable Resources Plugin XSS vulnerability

  A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.

  Jenkins Project Jenkins Lockable Resources Plugin org.6wind.jenkins:lockable-resources Web / CMS Maven
  Mar 28, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1694532
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1694536
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1694538
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1423.json
• report
  https://access.redhat.com/security/cve/CVE-2019-1003040
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1003040
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1003040
• article
  https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1353
• report
  https://access.redhat.com/security/cve/CVE-2019-1003041
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1003041
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1003041
• report
  https://access.redhat.com/security/cve/CVE-2019-1003042
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1003042
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1003042
• article
  https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361