GHSA-62pm-mgrh-7p69

Incorrect Authorization in Jenkins Script Security Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2019-16538

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:script-security	< 1.68	1.68

Details

As written in the advisory (Markdown source, shown as plain text).

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-16538 advisory
https://github.com/jenkinsci/script-security-plugin/commit/0e7da14171ed1d03ff72f6910392e630b40a8590 web
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1658 web
http://www.openwall.com/lists/oss-security/2019/11/21/1 web