CVE-2019-10356

Published: Jul 31, 2019Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts.

Affected (3)

Products: Jenkins: Script Security · Redhat: Openshift Container Platform

Jenkins

1 product

Script Security

Redhat

1 product

Openshift Container Platform

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Script Security	Up to 1.61

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 3.11
Redhat Openshift Container Platform	Version 4.1

References (10)

http://www.openwall.com/lists/oss-security/2019/07/31/1

Source: jenkinsci-cert@googlegroups.com

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2019:2594

Source: jenkinsci-cert@googlegroups.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2651

Source: jenkinsci-cert@googlegroups.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2662

Source: jenkinsci-cert@googlegroups.com

Third Party Advisory

https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20%282%29

Source: jenkinsci-cert@googlegroups.com

http://www.openwall.com/lists/oss-security/2019/07/31/1