Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
10 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. This allows attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved. Pipeline: Groovy Plugin 3993.v3e20a37282f8 refuses to rebuild a build whose main (Jenkinsfile) script is unapproved.
Recommended action: Upgrade to 3993.v3e20a (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.
Recommended action: Upgrade to 2.79 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Pipeline: Groovy Plugin allows pipelines to load Groovy source files. This is intended to be used to allow Global Shared Libraries to execute without sandbox protection. In Pipeline: Groovy Plugin 2689.v434009a31bf1 and earlier, any Groovy source files bundled with Jenkins core and plugins could be loaded this way and their methods executed. If a suitable Groovy source file is available on the classpath of Jenkins, sandbox protections can be bypassed. The Jenkins security team has been unable to identify any Groovy source files in Jenkins core or plugins that would allow attackers to execute dangerous code. While the severity of this issue is declared as High due to the potential impact, successful exploitation is considered very unlikely. Pipeline: Groovy Plugin 2692.v76b089ccd026 restricts which Groovy source files can be loaded in Pipelines. Groovy source files in public plugins intended to be executed in sandboxed pipelines have been identified and added to an allowlist. The new…
Recommended action: Upgrade to 2692.v76b (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM
Recommended action: Upgrade to 2.60 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.
Recommended action: Upgrade to 2.36.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
Recommended action: Upgrade to 2.65 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
Recommended action: Upgrade to 2.64 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Pipeline: Groovy Plugin prior to 2656.vf7ae7b75a457, 2.94.1, and 2.92.1 uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Recommended action: Upgrade to 2656.vf7a (pre-release), 2.94.1 or 2.92.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
2.92.12.94.12648.2651.v230593e03e9f· Vendor fix available
Issue
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.
Recommended action: Upgrade to 2648.2651.v230593e03e9f, 2.94.1 or 2.92.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds. This allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline. Pipeline: Groovy Plugin 2656.vf7ae7b75a457 does not allow builds containing password parameters to be replayed.
Recommended action: Upgrade to 2656.vf7a_e7b_75a_457 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.