Jenkins project · Pipeline: Declarative Plugin
The Pipeline: Declarative Plugin for Jenkins, version 1.3.3 and earlier, contains a sandbox bypass flaw in its Converter.groovy component within the pipeline-model-definition module. An attacker holding only Overall/Read permission can submit a crafted pipeline script to an HTTP endpoint, which can lead to arbitrary code execution on the Jenkins master JVM.
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Public exploit code (Metasploit) was available 14 days before disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.jenkinsci.plugins:pipeline-model-definition.
Upgrade to 1.3.4.1 or later
Set the version to 1.3.4.1 or later in your pom.xml or build.gradle.
The first fix for CVE-2019-1003002. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 1.3.4.1 | 1.3.4.1 |
“Up to” means the second version is the fix and is not affected.