SB2019102224 - Sandbox restrictions bypass in Puppet Enterprise Pipeline plugin for Jenkins
Published: October 22, 2019
Security Bulletin ID
SB2019102224
Severity
High
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-10458)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to the affected plugin specifies unsafe values in its custom Script Security whitelist. A remote authenticated attacker can bypass Script Security sandbox protection and execute arbitrary code on any Jenkins instance with this plugin installed.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.