Security controls bypass or absence In org.jenkins-ci.plugins.workflow:workflow-cps
Description
Sandbox bypass in Jenkins Pipeline: Groovy Plugin A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 2.64 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4.