GHSA-x6jx-cxg3-mggh

Source

https://github.com/advisories/GHSA-x6jx-cxg3-mggh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x6jx-cxg3-mggh/GHSA-x6jx-cxg3-mggh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x6jx-cxg3-mggh

Aliases

CVE-2019-1003002

Published

2022-05-13T01:15:20Z

Modified

2024-12-05T05:39:58.213546Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability

Details

Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements.

Both the pipeline validation REST APIs and actual script/pipeline execution are affected.

This allowed users with Overall/Read permission, or able to control Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the sandbox protection and execute arbitrary code on the Jenkins controller.

All known unsafe AST transformations in Groovy are now prohibited in sandboxed scripts.

Database specific

{
    "nvd_published_at": "2019-01-22T14:29:00Z",
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-25T21:22:51Z"
}

References

Affected packages

Maven / org.jenkinsci.plugins:pipeline-model-definition

Package

Name: org.jenkinsci.plugins:pipeline-model-definition; View open source insights on deps.dev
Purl: pkg:maven/org.jenkinsci.plugins/pipeline-model-definition

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.4.1

Affected versions

0.*

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.7.1

0.8

0.8.1

0.8.2

0.9

0.9.1

1.*

1.0

1.0.1

1.0.2

1.1

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.2-beta-2

1.2-beta-3

1.2-beta-4

1.2-beta-5

1.2

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3

1.3.1

1.3.2

1.3.3

1.3.3.1

1.3.4

Database specific

{
    "last_known_affected_version_range": "<= 1.3.3"
}