CVE-2019-10356: High severity Jenkins Script Security Jenkins vulnerability
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts.
Other sources
Sandbox protection in Jenkins Script Security Plugin could be circumvented through crafted subexpressions used as arguments to method pointer expressions. This allowed attackers able to specify sandboxed scripts to execute arbitrary code in the context of the Jenkins master JVM.
Method pointer subexpressions are now subject to sandbox protection.
External References:
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20(2)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.plugins:script-securityto a version that resolves this vulnerability.Fixed in 1.62 - Upgrade
Upgrade
redhat/jenkins-plugin-script-securityto a version that resolves this vulnerability.Fixed in 1.62
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10356?
CVE-2019-10356 is considered a critical severity vulnerability as it allows attackers to execute arbitrary code in sandboxed scripts.
How do I fix CVE-2019-10356?
To fix CVE-2019-10356, update the Jenkins Script Security Plugin to version 1.62 or later.
What versions of Jenkins Script Security Plugin are affected by CVE-2019-10356?
Jenkins Script Security Plugin versions 1.61 and earlier are affected by CVE-2019-10356.
Can CVE-2019-10356 impact my Jenkins instance?
Yes, CVE-2019-10356 can impact your Jenkins instance by allowing unauthorized execution of code, leading to potential data breaches.
Is Red Hat OpenShift affected by CVE-2019-10356?
Yes, certain versions of Red Hat OpenShift Container Platform may be affected by CVE-2019-10356 depending on the Jenkins plugins in use.