Jenkins Script Security plugin through version 1.50 is vulnerable to an incomplete fix to CVE-2019-1003000. Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. This affected an HTTP endpoint used to validate a user-submitted Groovy script that was not covered in the 2019-01-08 fix for SECURITY-1266 and allowed users with Overall/Read permission to bypass the sandbox protection and execute arbitrary code on the Jenkins master. The affected HTTP endpoint now applies a safe Groovy compiler configuration prohibiting unsafe AST transforming annotations. External Reference: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292 Upstream patches: https://github.com/jenkinsci/script-security-plugin/commit/35119273101af26792457ec177f34f6f4fa49d99
Created jenkins-script-security-plugin tracking bugs for this issue: Affects: fedora-all [bug 1670284]
openshift-enterprise 3.2-3.11 inclusive: affected Once openshift3/jenkins-1-rhel7, openshift3/jenkins-2-rhel7, openshift3/jenkins-slave-base-rhel7 container images have been released with these fixes, users of all versions of openshift-enterprise-3.2+ are encouraged to update these container images in their environment.
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.11 Via RHSA-2019:0739 https://access.redhat.com/errata/RHSA-2019:0739