Sandbox bypass in Jenkins Pipeline: Groovy Plugin

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-1003030 · ADVISORY
• access.redhat.com/errata/RHSA-2019:0739 · WEB
• jenkinsci/workflow-cps-plugin · PACKAGE
• jenkins.io/security/advisory/2019-03-06 · WEB
• cisa.gov/known-exploited-vulnerabilities-catalog · WEB
• packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html · WEB
• securityfocus.com/bid/107476 · Broken Link
• jenkins.io/security/advisory/2019-03-06 · Third Party Advisory
• CISA KEV · CVE-2019-1003030

org.jenkins-ci.plugins.workflow:workflow-cps のその他の脆弱性

• CVE-2024-52550高 8.0Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile…
• CVE-2022-43404緊急 9.9A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script …
• CVE-2022-43402緊急 9.9A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugi…
• CVE-2022-43401緊急 9.9A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin…
• CVE-2022-30945高 8.5Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenk…