CVE-2019-1003034

jenkins-job-dsl-plugin: Script security sandbox bypass in Job DSL Plugin (SECURITY-1342)

A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.

CVSS 3.1 · 9.9 Critical EPSS 3.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Job Dsl Openshift Openshift Container Platform

CVE-2019-1003031

jenkins-matrix-project-plugin: sandbox bypass in matrix project plugin

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

CVSS 3.1 · 9.9 Critical EPSS 3.5% KEV · Not listed

Vendors

Jenkins Redhat

Products

Matrix Project Openshift Openshift Container Platform

CVE-2019-1003024

jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1320)

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

CVSS 3.1 · 8.8 High EPSS 3.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift Openshift Container Platform

CVE-2019-1003014

jenkins-plugin-config-file-provider: Stored XSS vulnerability in Config File Provider Plugin (SECURITY-1253)

An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Config File Provider Openshift Openshift Container Platform

CVE-2019-1003013

jenkins-plugin-blueocean: XSS vulnerability via user description in Blue Ocean (SECURITY-1204)

An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.

CVSS 3.0 · 5.4 Medium EPSS 1.2% KEV · Not listed

Vendors

Jenkins Redhat

Products

Blue Ocean Openshift Openshift Container Platform

CVE-2019-1003012

jenkins-plugin-blueocean: Blue Ocean did not require CSRF tokens (SECURITY-1201)

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API.

CVSS 3.0 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Blue Ocean Openshift Openshift Container Platform

CVE-2019-1003011

jenkins-plugin-token-macro: Recursive token expansion results in information disclosure and DoS in Token Macro Plugin (SECURITY-1102)

An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.

CVSS 3.1 · 8.1 High EPSS 2.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Token Macro Openshift Openshift Container Platform

CVE-2019-1003010

jenkins-plugin-git: CSRF vulnerability in Git Plugin (SECURITY-1095)

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record.

CVSS 3.0 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Git Openshift Openshift Container Platform

CVE-2019-1003004

jenkins: deleting a user record will does not invalidate existing sessions

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.

CVSS 3.1 · 7.2 High EPSS 1.6% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift Openshift Container Platform

CVE-2019-1003003

jenkins: cookie crafted using Jenkins script console allows unauthorised access to Jenkins instance

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift Openshift Container Platform

CVE-2019-1003002

jenkins-plugin-pipeline-model-definition: Sandbox Bypass in Pipeline: Declarative

A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

CVSS 3.1 · 8.8 High EPSS 81.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Pipeline\ Openshift Openshift Container Platform

CVE-2019-1003001

jenkins-plugin-workflow-cps: Sandbox Bypass in Pipeline: Groovy Plugin

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

CVSS 3.1 · 8.8 High EPSS 86.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Pipeline\ Openshift Openshift Container Platform

CVE-2019-1003000

jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.

CVSS 3.1 · 8.8 High EPSS 98.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift Openshift Container Platform

CVE-2019-1002101

kubectl cp path traversal

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.

CVSS 3.0 · 6.4 Medium EPSS 12.8% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Openshift Container Platform

CVE-2019-1002100

kube-apiserver: DoS with crafted patch of type json-patch

In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.

CVSS 3.1 · 6.5 Medium EPSS 16.9% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Openshift Container Platform

CVE-2019-0542

xterm.js: Mishandling of special characters allows for remote code execution

A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.

CVSS 3.1 · 8.8 High EPSS 3.2% KEV · Not listed

Vendors

Redhat Xtermjs

Products

Openshift Openshift Container Platform Xterm.js

CVE-2018-3830

kibana: Cross-site scripting via the source field formatter

Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

CVSS 3.1 · 6.1 Medium EPSS 1.6% KEV · Not listed

Vendors

Elastic Redhat

Products

Kibana Openshift Openshift Container Platform

CVE-2018-20615

haproxy: Mishandling of priority flag in short HEADERS frame by HTTP/2 decoder allows for crash

An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame requires 5 extra bytes, and while these bytes are skipped, the total frame length was not re-checked to make sure they were present in the frame.

CVSS 3.0 · 7.5 High EPSS 4.5% KEV · Not listed

Vendors

Canonical Haproxy Opensuse and 1 more

Products

Ubuntu Linux Haproxy Leap and 4 more

CVE-2018-20103

haproxy: Infinite recursion via crafted packet allows stack exhaustion and denial of service

An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.

CVSS 3.0 · 7.5 High EPSS 6.6% KEV · Not listed

Vendors

Canonical Haproxy Redhat

Products

Ubuntu Linux Haproxy Openshift and 2 more

CVE-2018-20102

haproxy: Out-of-bounds read in dns.c:dns_validate_dns_response() allows for memory disclosure

An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses, remote attackers might be able read the 16 bytes corresponding to an AAAA record from the non-initialized part of the buffer, possibly accessing anything that was left on the stack, or even past the end of the 8193-byte buffer, depending on the value of accepted_payload_size.

CVSS 3.0 · 7.5 High EPSS 4.2% KEV · Not listed

Vendors

Canonical Haproxy Redhat

Products

Ubuntu Linux Haproxy Openshift and 2 more