Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2737 advisory.

  - jenkins-script-security-plugin: sandbox protection bypass leads to execute arbitrary code in sandboxed     scripts (CVE-2019-16538)

  - jenkins-pipeline-groovy-plugin: sandbox protection bypass through default parameter expressions in CPS-     transformed methods (CVE-2020-2109)

  - jenkins-script-security-plugin: sandbox protection bypass during script compilation phase by applying AST     transforming annotations (CVE-2020-2110)

  - jenkins-subversion-plugin: XSS in project repository base url (CVE-2020-2111)

  - jenkins-script-security-plugin: sandbox protection bypass via crafted constructor calls and crafted     constructor bodies (CVE-2020-2134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3616 advisory.

  - jenkins-script-security-plugin: sandbox protection bypass leads to execute arbitrary code in sandboxed     scripts (CVE-2019-16538)

  - jenkins-pipeline-groovy-plugin: sandbox protection bypass through default parameter expressions in CPS-     transformed methods (CVE-2020-2109)

  - jenkins-script-security-plugin: sandbox protection bypass during script compilation phase by applying AST     transforming annotations (CVE-2020-2110)

  - jenkins-subversion-plugin: XSS in project repository base url (CVE-2020-2111)

  - jenkins-script-security-plugin: sandbox protection bypass via crafted constructor calls and crafted     constructor bodies (CVE-2020-2134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2478 advisory.

  - jenkins-git-client-plugin: OS command injection via 'git ls-remote' (CVE-2019-10392)

  - jenkins-script-security-plugin: sandbox protection bypass leads to execute arbitrary code in sandboxed     scripts (CVE-2019-16538)

  - jenkins-pipeline-groovy-plugin: sandbox protection bypass through default parameter expressions in CPS-     transformed methods (CVE-2020-2109)

  - jenkins-script-security-plugin: sandbox protection bypass during script compilation phase by applying AST     transforming annotations (CVE-2020-2110)

  - jenkins-subversion-plugin: XSS in project repository base url (CVE-2020-2111)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default
    parameter expressions in CPS-transformed methods. (CVE-2020-2109)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3616 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * jenkins-script-security-plugin: sandbox protection bypass led to arbitrary code execution in sandboxed     scripts (CVE-2019-16538)

    * jenkins-pipeline-groovy-plugin: sandbox protection bypass through default parameter expressions in CPS-     transformed methods (CVE-2020-2109)

    * jenkins-script-security-plugin: sandbox protection bypass during script compilation phase by applying     AST transforming annotations (CVE-2020-2110)

    * jenkins-script-security-plugin: sandbox protection bypass via crafted constructor calls and crafted     constructor bodies (CVE-2020-2134)

    * jenkins-script-security-plugin: sandbox protection bypass led to arbitrary code execution     (CVE-2020-2135)

    * jenkins-subversion-plugin: XSS in project repository base URL (CVE-2020-2111)

    * jenkins-git-plugin: stored cross-site scripting (CVE-2020-2136)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2737 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * jenkins-script-security-plugin: A sandbox protection bypass in the Jenkins Script Security Plugin     allowed arbitrary code execution in sandboxed scripts. (CVE-2019-16538)

    * jenkins-pipeline-groovy-plugin: A sandbox protection in the Jenkins Pipeline: Groovy Plugin could be     circumvented through default parameter expressions in CPS-transformed methods. (CVE-2020-2109)

    * jenkins-script-security-plugin: A sandbox protection in the Jenkins Script Security Plugin could be     circumvented during the script compilation phase by applying AST transforming annotations. (CVE-2020-2110)

    * jenkins-script-security-plugin: A sandbox protection in the Jenkins Script Security Plugin could be     circumvented through crafted constructor calls and crafted constructor bodies. (CVE-2020-2134)

    * jenkins-script-security-plugin: A sandbox protection in the Jenkins Script Security Plugin could be     circumvented to arbitrary code execution. (CVE-2020-2135)

    * jenkins-subversion-plugin: XSS in the Project Repository Base URL resulted in a stored cross-site     scripting vulnerability. (CVE-2020-2111)

    * jenkins-git-plugin: An issue with the Jenkins Git Plugin resulted in a stored cross-site scripting     vulnerability. (CVE-2020-2136)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2478 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * jenkins-git-client-plugin: OS command injection via 'git ls-remote' (CVE-2019-10392)

    * jenkins-script-security-plugin: sandbox protection bypass leads to execute arbitrary code in sandboxed     scripts (CVE-2019-16538)

    * jenkins-pipeline-groovy-plugin: sandbox protection bypass through default parameter expressions in CPS-     transformed methods (CVE-2020-2109)

    * jenkins-script-security-plugin: sandbox protection bypass during script compilation phase by applying     AST transforming annotations (CVE-2020-2110)

    * jenkins-script-security-plugin: sandbox protection bypass via crafted constructor calls and crafted     constructor bodies (CVE-2020-2134)

    * jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution     (CVE-2020-2135)

    * jenkins-subversion-plugin: XSS in project repository base url (CVE-2020-2111)

    * jenkins-git-plugin: stored cross-site scripting (CVE-2020-2136)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
312559	RHCOS 4 : OpenShift Container Platform 4.4.z jenkins-2-plugins (RHSA-2020:2737)	Nessus	Red Hat Local Security Checks	Local	high
312483	RHCOS 4 : OpenShift Container Platform 4.3.35 jenkins-2-plugins (RHSA-2020:3616)	Nessus	Red Hat Local Security Checks	Local	high
312443	RHCOS 3 : OpenShift Container Platform 3.11 jenkins-2-plugins (RHSA-2020:2478)	Nessus	Red Hat Local Security Checks	Local	high
413172	SCA: security update for org.jenkins-ci.plugins.workflow:workflow-cps (GHSA-99mf-f3qh-wqrp)	Tenable Cloud Security	SCA Checks	Local	high
413172	SCA: security update for org.jenkins-ci.plugins.workflow:workflow-cps (GHSA-99mf-f3qh-wqrp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
140489	RHEL 7 : OpenShift Container Platform 4.3.35 jenkins-2-plugins (RHSA-2020:3616)	Nessus	Red Hat Local Security Checks	Local	high
137885	RHEL 7 : OpenShift Container Platform 4.4.z jenkins-2-plugins (RHSA-2020:2737)	Nessus	Red Hat Local Security Checks	Local	high
137667	RHEL 7 : OpenShift Container Platform 3.11 jenkins-2-plugins (RHSA-2020:2478)	Nessus	Red Hat Local Security Checks	Local	high

Detections

Analytics

CVE-2020-2109

high

Tenable Plugins

high

high

high

high

high

high

high

high