PT-2019-2637 · Jenkins · Jenkins Pipeline Remote Loader Plugin+1

Jesse Glick · Published 2019-05-31 · Updated 2023-10-25 · CVE-2019-10328

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline Remote Loader Plugin versions 1.4 and earlier

Description The issue is related to the custom whitelist for script security in the Jenkins Pipeline Remote Loader Plugin, which allowed attackers to invoke arbitrary methods and bypass typical sandbox protection. This could enable a remote attacker to bypass sandbox restrictions and invoke arbitrary methods.

Recommendations For Jenkins Pipeline Remote Loader Plugin versions 1.4 and earlier, update to version 1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's script security features until a patch is applied.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

CWE-183

Related Identifiers

BDU:2019-02523

CVE-2019-10328

GHSA-V558-FHW2-V46W

RHSA-2019:1636

Affected Products

Jenkins

Jenkins Pipeline Remote Loader Plugin

References · 11

• https://bdu.fstec.ru/vul/2019-02523 · Security Note
• https://access.redhat.com/errata/RHSA-2019:1636 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:1605 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v558-fhw2-v46w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10328 · Security Note
• https://jenkins.io/security/advisory/2019-05-31/#SECURITY-921 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10328 · Vendor Advisory
• https://github.com/jenkinsci/workflow-remote-loader-plugin · Note
• https://github.com/jenkinsci/workflow-remote-loader-plugin/commit/6f9d60f614359720ec98e22b80ba15e8bf88e712 · Note
• http://openwall.com/lists/oss-security/2019/05/31/2 · Note
• http://securityfocus.com/bid/108540 · Note