Description
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/02/12/3
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1713
Related Vulnerabilities
CVE-2023-26136 Vulnerability in maven package org.webjars.npm:tough-cookie
CVE-2020-36182 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2020-7596 Vulnerability in npm package codecov
CVE-2020-2292 Vulnerability in maven package org.jenkins-ci.plugins:release
CVE-2020-7709 Vulnerability in maven package org.webjars.npm:json-pointer