Description
Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Pipeline: Groovy Plugin | unspecified – ≤ 2.78 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.3.1597915133-1.el7 | RHSA-2020:3616, RHSA-2020:2737 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1591354111-1.el7 | RHSA-2020:2478 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins.workflow:workflow-cps | < 2.79 | 2.79 | GHSA-99mf-f3qh-wqrp |
Advisories 3
- RHSA-2020:2478 Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:3616 Red Hat Security Advisory: OpenShift Container Platform 4.3.35 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2020:2737 Red Hat Security Advisory: OpenShift Container Platform 4.4.z jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025