GHSA-76q7-r3g4-wvm4

Sandbox bypass vulnerability in Jenkins Script Security Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10400

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:script-security	< 1.63	1.63

Details

As written in the advisory (Markdown source, shown as plain text).

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10400 advisory
https://github.com/jenkinsci/script-security-plugin/commit/b28e4dc5584ef6515aeb9bc834691176546d0689 web
https://github.com/jenkinsci/script-security-plugin package
https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538 web
http://www.openwall.com/lists/oss-security/2019/09/12/2 web