CVE-2017-1000096
First published: Wed Oct 04 2017(Updated: )
Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Pipeline\ | <=2.36 | |
| maven/org.jenkins-ci.plugins.workflow:workflow-cps | <=2.36 | 2.36.1 |
| <=2.36 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-1000096?
CVE-2017-1000096 has a high severity rating due to the potential for arbitrary code execution.
How do I fix CVE-2017-1000096?
To fix CVE-2017-1000096, upgrade Jenkins Pipeline to version 2.36.1 or later.
What software is affected by CVE-2017-1000096?
CVE-2017-1000096 affects Jenkins Pipeline scripts in versions up to and including 2.36.
Can regular Jenkins users exploit CVE-2017-1000096?
Yes, regular Jenkins users can exploit CVE-2017-1000096 due to incomplete sandbox protections.
What types of attacks can CVE-2017-1000096 enable?
CVE-2017-1000096 can enable arbitrary code execution attacks within Jenkins environments.
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-mhwq-4mh7-fv7c
- alias/CVE-2017-1000096
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/author
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/jenkins
- canonical/jenkins pipeline\
- version/jenkins pipeline\/2.36
- package-manager/maven