Description

Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.

Remediation

References

http://www.openwall.com/lists/oss-security/2020/02/12/3

https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1713

Related Vulnerabilities

CVE-2019-10308 Vulnerability in maven package org.jvnet.hudson.plugins:analysis-core

CVE-2022-34271 Vulnerability in maven package org.apache.atlas:atlas-intg

CVE-2022-45347 Vulnerability in maven package org.apache.shardingsphere:shardingsphere-mysql-protocol

CVE-2020-8913 Vulnerability in maven package com.google.android.play:core

CVE-2020-13942 Vulnerability in maven package org.apache.unomi:unomi-persistence-elasticsearch-core

Severity

Critical

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory