PT-2019-2881 · Jenkins · Jenkins Script Security Plugin+1

CVE-2019-10356 · Publicado 2019-07-31 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.61 and earlier

Description A sandbox bypass issue related to the handling of method pointer expressions allows attackers to execute arbitrary code in sandboxed scripts. The vulnerability is related to errors in data processing, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations For Jenkins Script Security Plugin versions 1.61 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-466

CWE-254

Identificadores relacionados

BDU:2019-02850

CVE-2019-10356

GHSA-X25X-J4W4-7M59

RHSA-2019:2651

RHSA-2019:2662

Produtos afetados

Jenkins

Jenkins Script Security Plugin

Referências · 11

• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20%282%29 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10356 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-02850 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-x25x-j4w4-7m59 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:2594 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2019-10356 · Nota
• https://access.redhat.com/errata/RHSA-2019:2651 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20(2) · Nota
• https://access.redhat.com/errata/RHSA-2019:2662 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/07/31/1 · Nota
• https://osv.dev/vulnerability/CVE-2019-10356 · Aviso do Fabricante