A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined
    classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission
    to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute
    arbitrary code in the context of the Jenkins controller JVM. (CVE-2024-34145)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4597 advisory.

    Jenkins is a continuous integration server that monitors the execution of recurring jobs, such as software     builds or cron jobs.

    Security Fix(es):

    * jenkins-plugin/script-security: Sandbox bypass via sandbox-defined classes (CVE-2024-34145)

    * jenkins-plugin/script-security: Sandbox bypass via crafted constructor bodies (CVE-2024-34144)

    * jenkins-2-plugins: Improper input sanitization in HTML Publisher Plugin (CVE-2024-28149)

    * jenkins-2-plugins: git-server plugin arbitrary file read vulnerability (CVE-2024-23899)

    * jetty: Stop accepting new connections from valid clients (CVE-2024-22201)

    * ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

    * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when     unmarshaling certain forms of invalid JSON (CVE-2024-24786)

    * jenkins-2-plugins: matrix-project plugin path traversal vulnerability (CVE-2024-23900)

    * runc: File descriptor leak (CVE-2024-21626, Leaky-Vessels)

    * jenkins-2-plugins: git-server plugin arbitrary file read vulnerability (CVE-2024-23899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3635 advisory.

    Jenkins is a continuous integration server that monitors the execution of recurring jobs, such as software     builds or cron jobs.

    Security fixes:

    * jenkins-2-plugins: Git-server plugin has an arbitrary file read vulnerability (CVE-2024-23899)

    * jenkins-plugin/script-security: Sandbox bypass occurs via crafted constructor bodies (CVE-2024-34144)

    * jenkins-plugin/script-security: Sandbox bypass occurs via sandbox-defined classes (CVE-2024-34145)

    * jenkins-2-plugins: HTML Publisher plugin has improper input sanitization (CVE-2024-28149)

    * Jetty: Stops accepting new connections from valid clients (CVE-2024-22201)

    * SSH: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

    * golang-protobuf: Unmarshaling certain forms of invalid JSON in the protojson.Unmarshal function causes     an infinite loop in the encoding/protojson and internal/encoding/json packages of Golang-protobuf     (CVE-2024-24786)

    * jenkins-2-plugins: Matrix-project plugin has a path traversal vulnerability (CVE-2024-23900)

    For more details about these security issues, including their impact, CVSS scores, acknowledgments, and     other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3636 advisory.

    Jenkins is a continuous integration server that monitors the execution of     recurring jobs, such as software builds or cron jobs.

    Security fixes:

    * jenkins-2-plugins: Git-server plugin has an arbitrary file read     vulnerability (CVE-2024-23899)

    * jenkins-plugin/script-security: Sandbox bypass occurs via crafted     constructor bodies (CVE-2024-34144)

    * jenkins-plugin/script-security: Sandbox bypass occurs via sandbox-defined     classes (CVE-2024-34145)

    * jenkins-2-plugins: HTML Publisher plugin has improper input sanitization     (CVE-2024-28149)

    * jetty: Stops accepting new connections from valid clients     (CVE-2024-22201)

    * SSH: Prefix truncation attack on Binary Packet Protocol (BPP)     (CVE-2023-48795)

    * golang-protobuf: Unmarshaling certain forms of invalid JSON in the     protojson.Unmarshal function causes an infinite loop in the     encoding/protojson and internal/encoding/json packages of Golang-protobuf     (CVE-2024-24786).

    * jenkins-2-plugins: Matrix-project plugin has a path traversal     vulnerability (CVE-2024-23900)

    For more details about these security issues, including their impact, CVSS     scores, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3634 advisory.

    Jenkins is a continuous integration server that monitors the execution of     recurring jobs, such as software builds or cron jobs.

    Security fixes:

    * jenkins-2-plugins: Git-server plugin has an arbitrary file read     vulnerability (CVE-2024-23899)

    * jenkins-plugin/script-security: Sandbox bypass occurs via crafted     constructor bodies (CVE-2024-34144)

    * jenkins-plugin/script-security: Sandbox bypass occurs via sandbox-defined     classes (CVE-2024-34145)

    * jenkins-2-plugins: HTML Publisher plugin has improper input sanitization     (CVE-2024-28149)

    * jetty: Stops accepting new connections from valid clients     (CVE-2024-22201)

    * SSH: Prefix truncation attack on Binary Packet Protocol (BPP)     (CVE-2023-48795)

    * golang-protobuf: Unmarshaling certain forms of invalid JSON in the     protojson.Unmarshal function causes an infinite loop in the     encoding/protojson and internal/encoding/json packages of Golang-protobuf     (CVE-2024-24786)

    * jenkins-2-plugins: Matrix-project plugin has a path traversal     vulnerability (CVE-2024-23900)

    For more details about these security issues, including their impact, CVSS     scores, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - High Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts,     including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script     are intercepted, and various allowlists are checked to determine whether the call is to be allowed.
    Multiple sandbox bypass vulnerabilities exist in Script Security Plugin 1335.vf07d9ce377a_e and earlier:
    Crafted constructor bodies that invoke other constructors can be used to construct any subclassable type     via implicit casts. Sandbox-defined Groovy classes that shadow specific non-sandbox-defined classes can be     used to construct any subclassable type. These vulnerabilities allow attackers with permission to define     and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary     code in the context of the Jenkins controller JVM. These issues are caused by an incomplete fix of     SECURITY-2824. Script Security Plugin 1336.vf33a_a_9863911 has additional restrictions and sanity checks     to ensure that super constructors cannot be constructed without being intercepted by the sandbox: Calls to     to other constructors using this are now intercepted by the sandbox. Classes in packages that can be     shadowed by Groovy-defined classes are no longer ignored by the sandbox when intercepting super     constructor calls. (CVE-2024-34144, CVE-2024-34145)

  - Medium Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read     access to a Git repository over SSH. This allows attackers with a previously configured SSH public key but     lacking Overall/Read permission to access Git repositories. Git server Plugin 117.veb_68868fa_027 requires     Overall/Read permission to access Git repositories over SSH. (CVE-2024-34146)

  - Low Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global     configuration file jenkinsci.plugins.telegrambot.TelegramBotGlobalConfiguration.xml on the Jenkins     controller as part of its configuration. This token can be viewed by users with access to the Jenkins     controller file system. As of publication of this advisory, there is no fix. Learn why we announce this.
    (CVE-2024-34147)

  - Medium Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically sets the Java system     property hudson.model.ParametersAction.keepUndefinedParameters whenever a build is triggered from a     release tag with the 'Svn-Partial Release Manager' SCM. Doing so disables the fix for SECURITY-170 /     CVE-2016-3721. As of publication of this advisory, there is no fix. Learn why we announce this.
    (CVE-2024-34148)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
408899	SCA: security update for org.jenkins-ci.plugins:script-security (GHSA-2g4q-9vm9-9fw4)	Tenable Cloud Security	SCA Checks	high
408899	SCA: security update for org.jenkins-ci.plugins:script-security (GHSA-2g4q-9vm9-9fw4)	Tenable Self-Hosted Container Security	SCA Checks	high
202767	RHEL 8 : Red Hat Product OCP Tools 4.15 OpenShift Jenkins (RHSA-2024:4597)	Nessus	Red Hat Local Security Checks	critical
200120	RHEL 8 : Red Hat Product OCP Tools 4.12 Openshift Jenkins (RHSA-2024:3635)	Nessus	Red Hat Local Security Checks	critical
200118	RHEL 8 : Red Hat Product OCP Tools 4.13 OpenShift Jenkins (RHSA-2024:3636)	Nessus	Red Hat Local Security Checks	critical
200117	RHEL 8 : Red Hat Product OCP Tools 4.14 OpenShift Jenkins (RHSA-2024:3634)	Nessus	Red Hat Local Security Checks	critical
194914	Jenkins plugins Multiple Vulnerabilities (2024-05-02)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2024-34145

high

Tenable Plugins

high

high

critical

critical

critical

critical

critical