PT-2020-15316 · Jenkins · Jenkins Pipeline: Groovy Plugin+1

Nils Emmerich · Published 2020-02-12 · Updated 2023-10-25 · CVE-2020-2109

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Groovy Plugin versions 2.78 and earlier

Description The issue concerns the Jenkins Pipeline: Groovy Plugin, where sandbox protection can be circumvented. This is possible through default parameter expressions in CPS-transformed methods.

Recommendations For versions 2.78 and earlier, update to a version later than 2.78 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-2109

GHSA-99MF-F3QH-WQRP

RHSA-2020:2478

RHSA-2020:2737

RHSA-2020:3616

Affected Products

Jenkins

Jenkins Pipeline: Groovy Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-2109 · Security Note
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1710 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2109 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-99mf-f3qh-wqrp · Vendor Advisory
• https://github.com/jenkinsci/workflow-cps-plugin/commit/90b7f403882e1cab1dec49a011e377f440f8e003 · Note
• https://github.com/jenkinsci/workflow-cps-plugin/commit/41cb4e05eed6a901d0c8a8b0a460111a64c5e179 · Note
• http://openwall.com/lists/oss-security/2020/02/12/3 · Note