CVE-2017-1000095: Medium severity jenkins script security vulnerability
The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000095?
CVE-2017-1000095 has a medium severity level due to its potential to bypass script sandboxing restrictions.
How do I fix CVE-2017-1000095?
To fix CVE-2017-1000095, upgrade the Jenkins Script Security plugin to version 1.34 or later.
What software is affected by CVE-2017-1000095?
CVE-2017-1000095 affects Jenkins Script Security plugin versions prior to 1.34.
What risks does CVE-2017-1000095 pose?
CVE-2017-1000095 allows attackers to circumvent access restrictions, potentially leading to unauthorized access to sensitive data.
Is there a workaround for CVE-2017-1000095?
There are no known workarounds for CVE-2017-1000095, so upgrading is the recommended action.