Description
A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins Script Security Plugin | ≤ 1335.vf07d9ce377a_e | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.440.3.1716387933-3.el8 | RHSA-2024:4597, RHSA-2024:3636, RHSA-2024:3635 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.12.1716445211-1.el8 | RHSA-2024:4597, RHSA-2024:3636, RHSA-2024:3635 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:script-security | < 1336.vf33a | 1336.vf33a | GHSA-2g4q-9vm9-9fw4 |
Advisories 5
- RHSA-2024:4597 Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:3636 Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:3634 Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:3635 Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2024-1018 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2024