PT-2019-2880 · Jenkins · Jenkins Script Security Plugin+1

CVE-2019-10355 · Publicado 2019-07-31 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.61 and earlier

Description The issue is related to a sandbox bypass vulnerability in the handling of type casts, allowing attackers to execute arbitrary code in sandboxed scripts. This could potentially enable a remote attacker to execute arbitrary code or gain unauthorized access to confidential information.

Recommendations For Jenkins Script Security Plugin versions 1.61 and earlier, update to a version later than 1.61 to resolve the issue. As a temporary workaround, consider restricting the use of type casts in sandboxed scripts to minimize the risk of exploitation.

Correção

Incorrect Type Conversion or Cast

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-704

CWE-266

CWE-254

Identificadores relacionados

BDU:2019-02849

CVE-2019-10355

GHSA-P56J-X44H-G66J

RHSA-2019:2651

RHSA-2019:2662

Produtos afetados

Jenkins

Jenkins Script Security Plugin

Referências · 15

• https://github.com/jenkinsci/script-security-plugin · Nota
• https://github.com/jenkinsci/script-security-plugin/commit/5dc2e2465f309c772237a4b2de9caf61ba9b585b · Nota
• https://access.redhat.com/errata/RHSA-2019:2594 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10355 · Nota de Segurança
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465 · Nota
• https://access.redhat.com/errata/RHSA-2019:2662 · Aviso do Fabricante
• https://cvedetails.com/cve/CVE-2019-10355 · Nota
• https://bdu.fstec.ru/vul/2019-02849 · Nota de Segurança
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20%281%29 · Nota
• https://access.redhat.com/errata/RHSA-2019:2651 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2019-10355 · Nota
• http://openwall.com/lists/oss-security/2019/07/31/1 · Nota
• https://osv.dev/vulnerability/CVE-2019-10355 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-07-31 · Nota
• https://osv.dev/vulnerability/GHSA-p56j-x44h-g66j · Aviso do Fabricante