CVE-2019-10328 — Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin

Description

Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Pipeline Remote Loader Plugin	1.4 and earlier	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat OpenShift 4	jenkins-2-plugins	4.1.1561471763-1.el7	RHSA-2019:1636, RHBA-2019:2921
Red Hat OpenShift 3	atomic-enterprise-service-catalog +1	1:3.11.117-1.git.1.376e432.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-cluster-autoscaler	3.11.117-1.git.1.caa79fa.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-descheduler	3.11.117-1.git.1.1635b0a.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-dockerregistry	3.11.117-1.git.1.6a42b08.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-metrics-server	3.11.117-1.git.1.319d58e.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-node-problem-detector	3.11.117-1.git.1.0345fe3.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-service-idler	3.11.117-1.git.1.887bb82.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-web-console	3.11.117-1.git.1.be7a05c.el7	RHBA-2019:1605
Red Hat OpenShift 3	cri-o	1.11.14-1.rhaos3.11.gitd56660e.el7	RHBA-2019:1605
Red Hat OpenShift 3	golang-github-openshift-oauth-proxy	3.11.117-1.git.1.2b006d2.el7	RHBA-2019:1605
Red Hat OpenShift 3	jenkins	2.164.2.1555422716-1.el7	RHBA-2019:1605
Red Hat OpenShift 3	jenkins-2-plugins	3.11.1559667994-1.el7	RHBA-2019:1605
Red Hat OpenShift 3	openshift-ansible +4	3.11.123-1.git.0.db681ba.el7	RHBA-2019:1605
Red Hat OpenShift 3	openshift-enterprise-autoheal	3.11.117-1.git.1.ef32a58.el7	RHBA-2019:1605
Red Hat OpenShift 3	openshift-enterprise-cluster-capacity	3.11.117-1.git.1.6593fce.el7	RHBA-2019:1605
Red Hat OpenShift 3	prometheus +1	3.11.117-1.git.1.f52d417.el7	RHBA-2019:1605
Red Hat OpenShift 3	prometheus-alertmanager +1	3.11.117-1.git.1.207ef35.el7	RHBA-2019:1605
Red Hat OpenShift 3	prometheus-node-exporter +1	3.11.117-1.git.1.dcee33f.el7	RHBA-2019:1605

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:workflow-remote-loader	< 1.5	1.5	GHSA-v558-fhw2-v46w

Advisories 3

RHSA-2019:1636 Red Hat Security Advisory: OpenShift Container Platform 4.1 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
RHBA-2019:2921 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.2 RPM Release Advisory Red Hat Security Advisories (RHSA) · Jun 27, 2026
RHBA-2019:1605 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026

References

[oss-security] 20190531 Multiple vulnerabilities in Jenkins plugins mailing-list
108540 vdb-entry
RHBA-2019:1605 vendor-advisory
RHSA-2019:1636 vendor-advisory
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-921