Jenkins Plugin Sandbox Bypass and CSRF Vulnerabilities Advisory (CVE-2019-1003005/3006/3007)

Critical Vulnerability Information Vulnerability Advisory ID: Jenkins Security Advisory 2019-01-28 Affected Plugins Active Directory Plugin Blue Ocean Plugin Config File Provider Plugin Git Plugin GitHub Authentication Plugin Groovy Plugin Job Import Plugin Kanboard Plugin Monitoring Plugin OpenID Connect Authentication Plugin Script Security Plugin Token Macro Plugin Warnings Plugin Main Vulnerability Descriptions 1. Script Security Plugin - Sandbox Bypass CVE: SECURITY-1292 / CVE-2019-1003005 Severity: high Description: The sandbox protection of the Script Security plugin can be bypassed by applying unsafe AST transformation annotations such as . 2. Groovy Plugin - Sandbox Bypass CVE: SECURITY-1293 / CVE-2019-1003006 Severity: high Description: The sandbox protection of the Groovy plugin can be bypassed by applying unsafe AST transformation annotations such as . 3. Warnings Plugin - CSRF CVE: SECURITY-1295 (1) / CVE-2019-1003007 Severity: high Description: The sandbox protection of the Warnings plugin can be bypassed by applying unsafe AST transformation annotations such as . Remediation Recommendations Upgrade affected plugins to the recommended versions. Severity Levels High: SECURITY-1292, SECURITY-1293, SECURITY-1295(1), SECURITY-1295(2), SECURITY-905(1), SECURITY-1282, SECURITY-859 Medium: SECURITY-1295, SECURITY-1102, SECURITY-1153, SECURITY-1201, SECURITY-1204, SECURITY-1253, SECURITY-1302, SECURITY-818, SECURITY-797, SECURITY-292, SECURITY-1154, SECURITY-1271, SECURITY-1253, SECURITY-818, SECURITY-1271 Low: SECURITY-1095, SECURITY-602, SECURITY-797, SECURITY-1154, SECURITY-1201, SECURITY-1204, SECURITY-1253, SECURITY-818, SECURITY-1271

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Plugin Sandbox Bypass and CSRF Vulnerabilities Advisory (CVE-2019-1003005/3006/3007)