Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
CVSS Details
- CVSS 3.1 Base Score: 9.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade atomic-openshift-metrics-serverUpgrade atomic-enterprise-service-catalogUpgrade atomic-openshift-service-idlerUpgrade jenkinsUpgrade jenkins-2-pluginsUpgrade openshift-ansibleUpgrade golang-github-prometheus-alertmanagerUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshift-cluster-autoscalerUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-dockerregistryUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-node-problem-detectorUpgrade openshift-enterprise-autohealUpgrade atomic-openshift-deschedulerUpgrade cri-oUpgrade atomic-openshift-web-consoleUpgrade golang-github-prometheus-prometheus | Jul 4, 2019 | May 31, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub