Red Hat Security Advisory

RHSA-2019:1423

Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update

Released 2019-06-10 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins-3.11.1553788831-1.el7

Fixes 3 records

TI-2019-15886 CVE-2019-1003041 · GHSA-x74x-qf5j-35jh

A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows…

MEDIUM 48

A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03431 Published 2019-03-28 Partial fix · 2.65 CWE-470

TI-2019-15885 CVE-2019-1003040 · GHSA-3pv3-jj4h-p528

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows…

MEDIUM 48

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03431 Published 2019-03-28 Partial fix · 1.56 CWE-470

TI-2019-15887 CVE-2019-1003042 · GHSA-wqjj-c9cx-q7cf

Cross-site scripting in Jenkins Lockable Resources Plugin

LOW 27

A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01367 Published 2019-03-28 Fixed in 2.5 CWE-79