Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
CVSS Details
- CVSS 3.1 Base Score: 9.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade atomic-openshift-web-consoleUpgrade atomic-openshift-node-problem-detectorUpgrade golang-github-prometheus-prometheusUpgrade cri-oUpgrade atomic-openshift-deschedulerUpgrade openshift-enterprise-autohealUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshift-service-idlerUpgrade openshift-ansibleUpgrade atomic-openshift-dockerregistryUpgrade jenkinsUpgrade golang-github-prometheus-alertmanagerUpgrade golang-github-openshift-oauth-proxyUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-metrics-serverUpgrade atomic-openshift-cluster-autoscalerUpgrade jenkins-2-pluginsUpgrade atomic-enterprise-service-catalog | Jul 4, 2019 | May 31, 2019 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub