PT-2019-11794 · Jenkins · Jenkins Script Security Plugin+1

Nils Emmerich · CVE-2019-10400 · Publicado 2019-09-12 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.62 and earlier

Description A sandbox bypass issue related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allows attackers to execute arbitrary code in sandboxed scripts.

Recommendations For Jenkins Script Security Plugin versions 1.62 and earlier, update to a version later than 1.62 to resolve the issue.

Correção

Identificadores relacionados

CVE-2019-10400

GHSA-76Q7-R3G4-WVM4

RHSA-2019:4055

RHSA-2019:4089

RHSA-2019:4097

Produtos afetados

Jenkins

Jenkins Script Security Plugin

Referências · 7

• https://github.com/jenkinsci/script-security-plugin · Nota
• https://github.com/jenkinsci/script-security-plugin/commit/b28e4dc5584ef6515aeb9bc834691176546d0689 · Nota
• https://osv.dev/vulnerability/GHSA-76q7-r3g4-wvm4 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10400 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10400 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/09/12/2 · Nota