GHSA-9fp8-64xf-w957

Sandbox bypass vulnerability in Script Security Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10393

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:script-security	< 1.63	1.63

Details

As written in the advisory (Markdown source, shown as plain text).

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10393 advisory
https://github.com/jenkinsci/script-security-plugin/commit/b28e4dc5584ef6515aeb9bc834691176546d0689 web
https://github.com/jenkinsci/script-security-plugin package
https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538 web
http://www.openwall.com/lists/oss-security/2019/09/12/2 web