Description
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/10/01/2
https://access.redhat.com/errata/RHSA-2019:4055
https://access.redhat.com/errata/RHSA-2019:4089
https://access.redhat.com/errata/RHSA-2019:4097
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1579
Related Vulnerabilities
CVE-2023-26105 Vulnerability in npm package utilities
CVE-2020-13954 Vulnerability in maven package org.apache.cxf:cxf-rt-transports-http
CVE-2023-23848 Vulnerability in maven package org.jenkins-ci.plugins:synopsys-coverity
CVE-2020-2226 Vulnerability in maven package org.jenkins-ci.plugins:matrix-project
CVE-2020-7740 Vulnerability in npm package node-pdf-generator