GHSA-p56j-x44h-g66j

Incorrect Privilege Assignment in Jenkins Script Security Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2019-10355

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:script-security	< 1.62	1.62

Details

As written in the advisory (Markdown source, shown as plain text).

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10355 advisory
https://github.com/jenkinsci/script-security-plugin/commit/5dc2e2465f309c772237a4b2de9caf61ba9b585b web
https://access.redhat.com/errata/RHSA-2019:2594 web
https://access.redhat.com/errata/RHSA-2019:2651 web
https://access.redhat.com/errata/RHSA-2019:2662 web
https://github.com/jenkinsci/script-security-plugin package
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465 web
http://www.openwall.com/lists/oss-security/2019/07/31/1 web