Description
Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterceptable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Script Security Plugin | unspecified – ≤ 1.70 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.3.1597915133-1.el7 | RHSA-2020:3616, RHSA-2020:2737 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1591354111-1.el7 | RHSA-2020:2478 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:script-security | < 1.71 | 1.71 | GHSA-qvhf-3567-pc4v |
Advisories 3
- RHSA-2020:2478 Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:3616 Red Hat Security Advisory: OpenShift Container Platform 4.3.35 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2020:2737 Red Hat Security Advisory: OpenShift Container Platform 4.4.z jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025