{
  "GSD": {
    "alias": "CVE-2019-1003029",
    "description": "A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.",
    "id": "GSD-2019-1003029",
    "references": [
      "https://access.redhat.com/errata/RHSA-2019:0739",
      "https://packetstormsecurity.com/files/cve/CVE-2019-1003029"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-1003029"
      ],
      "details": "A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.",
      "id": "GSD-2019-1003029",
      "modified": "2023-12-13T01:23:44.815116Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "jenkinsci-cert@googlegroups.com",
        "ID": "CVE-2019-1003029",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Jenkins Script Security Plugin",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "1.53 and earlier"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Jenkins project"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29",
            "refsource": "MISC",
            "url": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29"
          },
          {
            "name": "http://www.securityfocus.com/bid/107476",
            "refsource": "MISC",
            "url": "http://www.securityfocus.com/bid/107476"
          },
          {
            "name": "https://access.redhat.com/errata/RHSA-2019:0739",
            "refsource": "MISC",
            "url": "https://access.redhat.com/errata/RHSA-2019:0739"
          },
          {
            "name": "http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,1.53]",
          "affected_versions": "All versions up to 1.53",
          "cvss_v2": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2019-04-10",
          "description": "A sandbox bypass vulnerability exists in Jenkins Script Security Plugin in `src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java`, `src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java` allowing attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.",
          "fixed_versions": [
            "1.54"
          ],
          "identifier": "CVE-2019-1003029",
          "identifiers": [
            "CVE-2019-1003029"
          ],
          "not_impacted": "All versions after 1.53",
          "package_slug": "maven/org.jenkins-ci.plugins/script-security",
          "pubdate": "2019-03-08",
          "solution": "Upgrade to version 1.54 or above.",
          "title": "Protection Mechanism Failure",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2019-1003029",
            "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(1)"
          ],
          "uuid": "ae3d0c84-c8dd-4a42-b700-366c0a7a1502"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.53",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2019-1003029"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "107476",
              "refsource": "BID",
              "tags": [
                "Broken Link"
              ],
              "url": "http://www.securityfocus.com/bid/107476"
            },
            {
              "name": "RHSA-2019:0739",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2019:0739"
            },
            {
              "name": "http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html"
            },
            {
              "name": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29",
              "refsource": "MISC",
              "tags": [],
              "url": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.1,
          "impactScore": 6.0
        }
      },
      "lastModifiedDate": "2023-10-25T18:16Z",
      "publishedDate": "2019-03-08T21:29Z"
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for jenkins-2-plugins is now available for Red Hat OpenShift Container Platform 3.11.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron.\n\nSecurity fix(es):\n\n* jenkins-plugin-script-security: Sandbox bypass in script security plug-in (CVE-2019-1003005)\n* jenkins-plugin-script-security: Sandbox bypass in script security plug-in (CVE-2019-1003024)\n* jenkins-plugin-script-security: Sandbox bypass in script security plug-in (CVE-2019-1003029)\n* jenkins-plugin-workflow-cps: Sandbox bypass in pipeline: Groovy plug-in (CVE-2019-1003030)\n* jenkins-matrix-project-plugin: Sandbox bypass in matrix project plug-in (CVE-2019-1003031)\n* jenkins-job-dsl-plugin: Script security sandbox bypass in job DSL plug-in (CVE-2019-1003034)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:0739",
        "url": "https://access.redhat.com/errata/RHSA-2019:0739"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1670283",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1670283"
      },
      {
        "category": "external",
        "summary": "1684556",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1684556"
      },
      {
        "category": "external",
        "summary": "1689873",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689873"
      },
      {
        "category": "external",
        "summary": "1689886",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689886"
      },
      {
        "category": "external",
        "summary": "1690663",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1690663"
      },
      {
        "category": "external",
        "summary": "1690665",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1690665"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0739.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update",
    "tracking": {
      "current_release_date": "2024-11-05T21:01:44+00:00",
      "generator": {
        "date": "2024-11-05T21:01:44+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2019:0739",
      "initial_release_date": "2019-04-10T18:34:29+00:00",
      "revision_history": [
        {
          "date": "2019-04-10T18:34:29+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-04-10T18:34:29+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T21:01:44+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 3.11",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 3.11",
                  "product_id": "7Server-RH7-RHOSE-3.11",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:3.11::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jenkins-2-plugins-0:3.11.1552336312-1.el7.src",
                "product": {
                  "name": "jenkins-2-plugins-0:3.11.1552336312-1.el7.src",
                  "product_id": "jenkins-2-plugins-0:3.11.1552336312-1.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jenkins-2-plugins@3.11.1552336312-1.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
                "product": {
                  "name": "jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
                  "product_id": "jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jenkins-2-plugins@3.11.1552336312-1.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch as a component of Red Hat OpenShift Container Platform 3.11",
          "product_id": "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch"
        },
        "product_reference": "jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jenkins-2-plugins-0:3.11.1552336312-1.el7.src as a component of Red Hat OpenShift Container Platform 3.11",
          "product_id": "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
        },
        "product_reference": "jenkins-2-plugins-0:3.11.1552336312-1.el7.src",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-1003005",
      "cwe": {
        "id": "CWE-96",
        "name": "Improper Neutralization of Directives in Statically Saved Code (\u0027Static Code Injection\u0027)"
      },
      "discovery_date": "2019-01-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1670283"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Jenkins Script Security plugin through version 1.50. The fix for CVE-2019-1003000 was found to be incomplete. Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. This affected an HTTP endpoint used to validate a user-submitted Groovy script that was not covered in the 2019-01-08 fix for SECURITY-1266 and allowed users with Overall/Read permission to bypass the sandbox protection and execute arbitrary code on the Jenkins master. The affected HTTP endpoint now applies a safe Groovy compiler configuration prohibiting unsafe AST transforming annotations. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
          "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-1003005"
        },
        {
          "category": "external",
          "summary": "RHBZ#1670283",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1670283"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1003005",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-1003005"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003005",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003005"
        },
        {
          "category": "external",
          "summary": "https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292",
          "url": "https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292"
        }
      ],
      "release_date": "2019-01-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-10T18:34:29+00:00",
          "details": "See the following documentation, which will be updated shortly for release\n3.11.98, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0739"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)"
    },
    {
      "cve": "CVE-2019-1003024",
      "cwe": {
        "id": "CWE-96",
        "name": "Improper Neutralization of Directives in Statically Saved Code (\u0027Static Code Injection\u0027)"
      },
      "discovery_date": "2019-02-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1684556"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Jenkins script security sandbox. The previously implemented script security sandbox protections prohibiting the use of unsafe AST transforming annotations such as @Grab could be circumvented through use of various Groovy language features including the use of AnnotationCollector, import aliasing, and referencing annotation types using their full class name. This allows users with Overall/Read permission, or the ability to control Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the sandbox protection and execute arbitrary code on the Jenkins master. The highest threat from this vulnerability is to data confidentiality and integrity and system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1320)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects the jenkins-2-plugins RPM which is installed in the openshift3/jenkins-2-rhel7 container image. Security updates for this image are only released for versions 3.11 and 4.x of OpenShift Container Platform. The 3.11 version of the openshift3/jenkins-2-rhel7 container image is supported for use with previous versions of OpenShift Container Platform up to 3.4. For more information, refer to the OpenShift Jenkins README:\n\nhttps://github.com/openshift/jenkins/blob/master/README.md#jenkins-security-advisories-the-master-image-from-this-repository-and-the-oc-binary",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
          "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-1003024"
        },
        {
          "category": "external",
          "summary": "RHBZ#1684556",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1684556"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1003024",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-1003024"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003024",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003024"
        },
        {
          "category": "external",
          "summary": "https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1320",
          "url": "https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1320"
        }
      ],
      "release_date": "2019-02-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-10T18:34:29+00:00",
          "details": "See the following documentation, which will be updated shortly for release\n3.11.98, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0739"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1320)"
    },
    {
      "cve": "CVE-2019-1003029",
      "cwe": {
        "id": "CWE-96",
        "name": "Improper Neutralization of Directives in Statically Saved Code (\u0027Static Code Injection\u0027)"
      },
      "discovery_date": "2019-03-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689873"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Jenkins Script Security plugin version 1.53. An attacker with Overall/Read permissions is able to escape the sandbox and execute arbitrary code on the Jenkins master JVM. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jenkins-plugin-script-security: sandbox bypass in script security plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
          "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-1003029"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689873",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689873"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1003029",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-1003029"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003029",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003029"
        },
        {
          "category": "external",
          "summary": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20",
          "url": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2019-03-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-10T18:34:29+00:00",
          "details": "See the following documentation, which will be updated shortly for release\n3.11.98, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0739"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-04-25T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jenkins-plugin-script-security: sandbox bypass in script security plugin"
    },
    {
      "cve": "CVE-2019-1003030",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1690665"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Jenkins Workflow CPS plugin. Parsing, compilation, and script instantiations provided by a crafted Groovy script could escape the sandbox allowing users to execute arbitrary code on the Jenkins master. The highest risk from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jenkins-plugin-workflow-cps: Sandbox bypass in Pipeline: Groovy Plugin (SECURITY-1336(2))",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
          "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-1003030"
        },
        {
          "category": "external",
          "summary": "RHBZ#1690665",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1690665"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1003030",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-1003030"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003030",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003030"
        },
        {
          "category": "external",
          "summary": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(2)",
          "url": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(2)"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2019-03-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-10T18:34:29+00:00",
          "details": "See the following documentation, which will be updated shortly for release\n3.11.98, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0739"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-03-25T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jenkins-plugin-workflow-cps: Sandbox bypass in Pipeline: Groovy Plugin (SECURITY-1336(2))"
    },
    {
      "cve": "CVE-2019-1003031",
      "cwe": {
        "id": "CWE-96",
        "name": "Improper Neutralization of Directives in Statically Saved Code (\u0027Static Code Injection\u0027)"
      },
      "discovery_date": "2019-03-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689886"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Jenkins Matrix Project plugin version 1.13. An attacker with Job/Configure permission can bypass the sandbox and can execute arbitrary code on the Jenkins master JVM. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jenkins-matrix-project-plugin: sandbox bypass in matrix project plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
          "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-1003031"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689886",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689886"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1003031",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-1003031"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003031",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003031"
        },
        {
          "category": "external",
          "summary": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1339",
          "url": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1339"
        }
      ],
      "release_date": "2019-03-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-10T18:34:29+00:00",
          "details": "See the following documentation, which will be updated shortly for release\n3.11.98, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0739"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jenkins-matrix-project-plugin: sandbox bypass in matrix project plugin"
    },
    {
      "cve": "CVE-2019-1003034",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1690663"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Jenkins Job DSL plugin. Parsing, compilation, and script instantiations provided by a crafted Groovy script could escape the sandbox allowing users to execute arbitrary code on the Jenkins master. The highest risk from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jenkins-job-dsl-plugin: Script security sandbox bypass in Job DSL Plugin (SECURITY-1342)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
          "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-1003034"
        },
        {
          "category": "external",
          "summary": "RHBZ#1690663",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1690663"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1003034",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-1003034"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003034",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003034"
        },
        {
          "category": "external",
          "summary": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1342",
          "url": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1342"
        }
      ],
      "release_date": "2019-03-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-10T18:34:29+00:00",
          "details": "See the following documentation, which will be updated shortly for release\n3.11.98, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0739"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.noarch",
            "7Server-RH7-RHOSE-3.11:jenkins-2-plugins-0:3.11.1552336312-1.el7.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jenkins-job-dsl-plugin: Script security sandbox bypass in Job DSL Plugin (SECURITY-1342)"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:script-security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.54"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-1003029"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-01T20:08:15Z",
    "nvd_published_at": "2019-03-08T21:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.",
  "id": "GHSA-xvxq-hq48-xphm",
  "modified": "2024-07-05T17:55:06Z",
  "published": "2022-05-13T01:00:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003029"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:0739"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/script-security-plugin"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(1)"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/107476"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sandbox bypass in Script Security Plugin"
}