CVE-2017-1000096: High severity jenkins pipeline vulnerability
Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000096?
CVE-2017-1000096 has a high severity rating due to the potential for arbitrary code execution.
How do I fix CVE-2017-1000096?
To fix CVE-2017-1000096, upgrade Jenkins Pipeline to version 2.36.1 or later.
What software is affected by CVE-2017-1000096?
CVE-2017-1000096 affects Jenkins Pipeline scripts in versions up to and including 2.36.
Can regular Jenkins users exploit CVE-2017-1000096?
Yes, regular Jenkins users can exploit CVE-2017-1000096 due to incomplete sandbox protections.
What types of attacks can CVE-2017-1000096 enable?
CVE-2017-1000096 can enable arbitrary code execution attacks within Jenkins environments.