Jenkins project · Pipeline: Groovy Plugin
A sandbox bypass in the Pipeline: Groovy Plugin for Jenkins, in the CpsFlowDefinition.java and CpsGroovyShellFactory.java components, is the flaw. An attacker holding Overall/Read permission can submit a pipeline script to an HTTP endpoint and execute arbitrary code on the Jenkins master JVM.
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
First seen exploited 5 years after disclosure. Public exploit code (Metasploit) was available 14 days before disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
3 packages in 1 ecosystem. Main package: org.jenkins-ci.plugins:pipeline-model-definition.
Upgrade to 1.3.4.1 or later
Set the version to 1.3.4.1 or later in your pom.xml or build.gradle.
The first fix for CVE-2019-1003001. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 1.3.4.1 | 1.3.4.1 |
“Up to” means the second version is the fix and is not affected.
Forks, repackagings and products that include the affected code. Each has its own fixed version.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.