Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-43637

Arbitrary code execution vulnerability

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Critical Critical
    • postbuildscript-plugin
    • None
    • Jenkins ver. 2.46.1

      According to https://jenkins.io/security/advisory/2017-04-10/ this plugin suffers from arbitrary code execution vulnerability.

          [JENKINS-43637] Arbitrary code execution vulnerability

          Giacomo Boccardo created issue -

          Daniel Heid added a comment -

          Hi! I integrated the SecureGroovyScript class into the plugin to solve the mentioned vulnerability:

          https://github.com/jenkinsci/postbuildscript-plugin/pull/15

          Daniel Heid added a comment - Hi! I integrated the SecureGroovyScript class into the plugin to solve the mentioned vulnerability: https://github.com/jenkinsci/postbuildscript-plugin/pull/15
          Daniel Heid made changes -
          Status Original: Open [ 1 ] New: In Progress [ 3 ]
          Daniel Heid made changes -
          Status Original: In Progress [ 3 ] New: Open [ 1 ]
          Daniel Heid made changes -
          Status Original: Open [ 1 ] New: In Progress [ 3 ]

          SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Daniel Heid
          Path:
          src/main/java/org/jenkinsci/plugins/postbuildscript/service/ScriptExecutor.java
          http://jenkins-ci.org/commit/postbuildscript-plugin/a6e82abb5c5be6b5303f548bffc7ebbe9ae27d76
          Log:
          JENKINS-43637 Secures groovy script execution

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Daniel Heid Path: src/main/java/org/jenkinsci/plugins/postbuildscript/service/ScriptExecutor.java http://jenkins-ci.org/commit/postbuildscript-plugin/a6e82abb5c5be6b5303f548bffc7ebbe9ae27d76 Log: JENKINS-43637 Secures groovy script execution

          SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Daniel Heid
          Path:
          .gitignore
          pom.xml
          src/main/java/org/jenkinsci/plugins/postbuildscript/PostBuildScript.java
          src/main/java/org/jenkinsci/plugins/postbuildscript/PostBuildScriptListener.java
          src/main/java/org/jenkinsci/plugins/postbuildscript/service/ScriptExecutor.java
          http://jenkins-ci.org/commit/postbuildscript-plugin/3d33744ba1c459beb8e6c46c1112ab236b18a699
          Log:
          Merge pull request #15 from dheid/master

          JENKINS-43637 Secures groovy script execution

          Compare: https://github.com/jenkinsci/postbuildscript-plugin/compare/cdceecee4243...3d33744ba1c4

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Daniel Heid Path: .gitignore pom.xml src/main/java/org/jenkinsci/plugins/postbuildscript/PostBuildScript.java src/main/java/org/jenkinsci/plugins/postbuildscript/PostBuildScriptListener.java src/main/java/org/jenkinsci/plugins/postbuildscript/service/ScriptExecutor.java http://jenkins-ci.org/commit/postbuildscript-plugin/3d33744ba1c459beb8e6c46c1112ab236b18a699 Log: Merge pull request #15 from dheid/master JENKINS-43637 Secures groovy script execution Compare: https://github.com/jenkinsci/postbuildscript-plugin/compare/cdceecee4243...3d33744ba1c4
          Daniel Heid made changes -
          Status Original: In Progress [ 3 ] New: Open [ 1 ]
          Daniel Heid made changes -
          Resolution New: Fixed [ 1 ]
          Status Original: Open [ 1 ] New: Closed [ 6 ]
          Daniel Heid made changes -
          Assignee Original: Gregory Boissinot [ gbois ] New: Daniel Heid [ dheid ]

            dheid Daniel Heid
            jhack Giacomo Boccardo
            Votes:
            1 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: