CVE-2019-10355: Incorrect Type Cast
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.
Other sources
Sandbox protection in Jenkins Script Security Plugin could be circumvented by casting crafted objects to other types. This allowed attackers able to specify sandboxed scripts to invoke constructors that weren’t whitelisted.
Additionally, this could be used to read arbitrary files on the Jenkins master.
Casting collections to other types as an alternative syntax for constructor invocation is now only allowed when the collection type is defined in java.util, and prohibited otherwise. Casting files and enums to arrays is now intercepted by the sandbox and treated as the invocation of an equivalent method.
External References:
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20(1)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.plugins:script-securityto a version that resolves this vulnerability.Fixed in 1.62 - Upgrade
Upgrade
redhat/jenkins-plugin-script-securityto a version that resolves this vulnerability.Fixed in 1.62
Event History
Frequently Asked Questions
What is CVE-2019-10355?
CVE-2019-10355 is a sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier that allows attackers to execute arbitrary code in sandboxed scripts.
What is the severity of CVE-2019-10355?
The severity of CVE-2019-10355 is high, with a CVSS score of 8.8.
How does CVE-2019-10355 affect Jenkins Script Security Plugin?
CVE-2019-10355 affects Jenkins Script Security Plugin versions 1.61 and earlier.
How can I fix CVE-2019-10355?
To fix CVE-2019-10355, you should upgrade Jenkins Script Security Plugin to version 1.62.
Are there any additional references for CVE-2019-10355?
Yes, you can find additional information about CVE-2019-10355 at the following references: - [Jenkins Security Advisory](https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465) - [Redhat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1735516) - [OpenShift Jenkins README](https://github.com/openshift/jenkins/blob/master/README.md#jenkins-security-advisories-the-master-image-from-this-repository-and-the-oc-binary)