The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade jenkinsUpgrade atomic-openshift-node-problem-detectorUpgrade golang-github-prometheus-prometheusUpgrade openshift-enterprise-autohealUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-web-consoleUpgrade atomic-openshift-dockerregistryUpgrade openshift-ansibleUpgrade haproxyUpgrade openshift-enterprise-cluster-capacityUpgrade golang-github-prometheus-alertmanagerUpgrade atomic-openshift-service-idlerUpgrade atomic-openshift-cluster-autoscalerUpgrade jenkins-2-pluginsUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshift-metrics-serverUpgrade atomic-openshiftUpgrade atomic-enterprise-service-catalogUpgrade atomic-openshift-descheduler | Mar 15, 2019 | Jan 8, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub