Red Hat Security Advisory: Red Hat OpenShift Container Platform 4.1 jenkins-2-plugins security update

Fixed packages 1

Vulnerabilities 3

• High 8.8
  CVE-2019-10355

  Incorrect Privilege Assignment in Jenkins Script Security Plugin

  A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Jul 31, 2019
• High 8.8
  CVE-2019-10356

  Return of Pointer Value Outside of Expected Rang in Jenkins Script Security Plugin

  A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts.

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Jul 31, 2019
• Medium 4.3
  CVE-2019-10357

  Missing Authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin

  A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.

  Jenkins Project Jenkins Pipeline: Shared Groovy Libraries Plugin org.jenkins-ci.plugins.workflow:workflow-cps-global-lib Web / CMS Maven
  Jul 31, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1735515
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1735518
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1735521
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2662.json
• report
  https://access.redhat.com/security/cve/CVE-2019-10355
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10355
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10355
• article
  https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20(1)
• report
  https://access.redhat.com/security/cve/CVE-2019-10356
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10356
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10356
• article
  https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20(2)
• report
  https://access.redhat.com/security/cve/CVE-2019-10357
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10357
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10357
• article
  https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1422