[Bug 1819078] New: CVE-2020-2135 jenkins-2-plugins: sandbox protection bypass leads to arbitrary code execution
2:32 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Bug ID: 1819078
Summary: CVE-2020-2135 jenkins-2-plugins: sandbox protection
bypass leads to arbitrary code execution
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jenkins Script Security Plugin 1.70 and earlier,
where sandbox protection earlier could be circumvented through crafted method
calls on objects that implement GroovyInterceptable.
Reference:
http://www.openwall.com/lists/oss-security/2020/03/09/1
--
You are receiving this mail because:
You are on the CC list for the bug.
2:33 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-2-plugins: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Dhananjay Arunesh <darunesh(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1819079
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1819079
[Bug 1819079] CVE-2020-2135 jenkins-script-security-plugin: jenkins-2-plugins:
sandbox protection bypass leads to arbitrary code execution [fedora-30]
--
You are receiving this mail because:
You are on the CC list for the bug.
2:33 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-2-plugins: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
--- Comment #1 from Dhananjay Arunesh <darunesh(a)redhat.com> ---
Created jenkins-script-security-plugin tracking bugs for this issue:
Affects: fedora-30 [bug 1819079]
--
You are receiving this mail because:
You are on the CC list for the bug.
2:34 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-2-plugins: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Dhananjay Arunesh <darunesh(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1819080
--
You are receiving this mail because:
You are on the CC list for the bug.
2:35 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-2-plugins: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
--- Comment #2 from Dhananjay Arunesh <darunesh(a)redhat.com> ---
External References:
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1754
--
You are receiving this mail because:
You are on the CC list for the bug.
4:28 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Tomas Hoger <thoger(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version| |jenkins-script-security-plu
| |gin 1.71
Summary|CVE-2020-2135 |CVE-2020-2135
|jenkins-2-plugins: sandbox |jenkins-script-security-plu
|protection bypass leads to |gin: sandbox protection
|arbitrary code execution |bypass leads to arbitrary
| |code execution
--
You are receiving this mail because:
You are on the CC list for the bug.
9:43 p.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1819538, 1819531, 1819543
--
You are receiving this mail because:
You are on the CC list for the bug.
10:07 p.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On|1819531 |
--
You are receiving this mail because:
You are on the CC list for the bug.
10:08 p.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1819530
--
You are receiving this mail because:
You are on the CC list for the bug.
10:17 p.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On|1819543 |
--
You are receiving this mail because:
You are on the CC list for the bug.
10:18 p.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1819544
--
You are receiving this mail because:
You are on the CC list for the bug.
4:12 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Akram Ben Aissi <abenaiss(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1819647
--
You are receiving this mail because:
You are on the CC list for the bug.
10:56 p.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1820007, 1820008
--
You are receiving this mail because:
You are on the CC list for the bug.
1:33 p.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Bug 1819078 depends on bug 1819079, which changed state.
Bug 1819079 Summary: CVE-2020-2135 jenkins-script-security-plugin: sandbox protection
bypass leads to arbitrary code execution [fedora-30]
https://bugzilla.redhat.com/show_bug.cgi?id=1819079
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |EOL
--
You are receiving this mail because:
You are on the CC list for the bug.
2:19 p.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Akram Ben Aissi <abenaiss(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1819997
--
You are receiving this mail because:
You are on the CC list for the bug.
12:44 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On|1819997 |
--
You are receiving this mail because:
You are on the CC list for the bug.
5:38 p.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
--- Comment #7 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 3.11
Via RHSA-2020:2478 https://access.redhat.com/errata/RHSA-2020:2478
--
You are receiving this mail because:
You are on the CC list for the bug.
5:38 p.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:2478
--
You are receiving this mail because:
You are on the CC list for the bug.
6:20 p.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |ERRATA
Last Closed| |2020-06-17 23:20:25
--- Comment #8 from Product Security DevOps Team <prodsec-dev(a)redhat.com> ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-2135
--
You are receiving this mail because:
You are on the CC list for the bug.
9:41 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
--- Comment #9 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.4
Via RHSA-2020:2737 https://access.redhat.com/errata/RHSA-2020:2737
--
You are receiving this mail because:
You are on the CC list for the bug.
9:41 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:2737
--
You are receiving this mail because:
You are on the CC list for the bug.
9:55 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Vikas Laad <vlaad(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1873177
--
You are receiving this mail because:
You are on the CC list for the bug.
10:22 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
--- Comment #10 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.3
Via RHSA-2020:3616 https://access.redhat.com/errata/RHSA-2020:3616
--
You are receiving this mail because:
You are on the CC list for the bug.
10:22 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:3616
--
You are receiving this mail because:
You are on the CC list for the bug.
4:31 a.m.
New subject: [Bug 1819078] CVE-2020-2135 jenkins-script-security-plugin: sandbox protection bypass leads to arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
jawed <jkhelil(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1873182
--
You are receiving this mail because:
You are on the CC list for the bug.
1293
days inactive
1488
days old
java-sig-commits@lists.fedoraproject.org
24 comments
1 participants
participants (1)
-
bugzilla＠redhat.com