GHSA-qxf8-8837-hq7w

Script security sandbox bypass in Matrix Project Plugin

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-1003031

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:matrix-project	< 1.14	1.14

Details

As written in the advisory (Markdown source, shown as plain text).

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-1003031 advisory
https://github.com/jenkinsci/matrix-project-plugin/commit/765fc39694b31f8dd6e3d27cf51d1708b5df2be7 web
https://access.redhat.com/errata/RHSA-2019:0739 web
https://github.com/jenkinsci/matrix-project-plugin package
https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1339 web
http://www.securityfocus.com/bid/107476 web