PT-2019-11852 · Puppet+1 · Jenkins Puppet Enterprise Pipeline+1

Jesse Glick · Published 2019-10-16 · Updated 2023-10-25 · CVE-2019-10458

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Puppet Enterprise Pipeline versions 1.3.1 and earlier

Description The issue allows attackers to execute arbitrary code if they can execute Script Security protected scripts, due to unsafe values specified in the custom Script Security whitelist.

Recommendations For Jenkins Puppet Enterprise Pipeline versions 1.3.1 and earlier, update to a version later than 1.3.1 to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-183

Related Identifiers

CVE-2019-10458

GHSA-MJ9C-VJP9-PGGH

Affected Products

Jenkins

Jenkins Puppet Enterprise Pipeline

References · 5

• https://jenkins.io/security/advisory/2019-10-16/#SECURITY-918 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10458 · Security Note
• https://osv.dev/vulnerability/GHSA-mj9c-vjp9-pggh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10458 · Vendor Advisory
• https://github.com/jenkinsci/puppet-enterprise-pipeline-plugin · Note