PkgSeer

Vulnerability GHSA-qjq3-wqj5-g37q

High Risk

4 months ago

Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries

==589.vb_a_b_4a_a_8c443c, ==591.v3a_7f422b_d058, ==593.595.vfc6485d13dcd, ==593.va_a_fc25d520e9, ==598.vcd66b_a_336510, ==612.614.v48dcb_f62a_640, ==612.v84da_9c54906d, ==613.v9c41a_160233f, ==621.vb_44ce045b_582, ==629.vb_5627b_ee2104, ==656.va_a_ceeb_6ffb_f7, ==671.v07c339c842e8, ==673.vb_c5d5948283c, ==685.v8ee9ed91d574, ==687.v62591d623759, ==689.veec561a_dee13, ==700.v0e341fa_57d53, ==704.vc58b_8890a_384, ==710.v4b_94b_077a_808, ==727.ve832a_9244dfa_, ==730.ve57b_34648c63, ==740.va_2701257fe8d, ==744.v5b_556ee7c253, ==745.vdf6077913de0, ==749.v70084559234a_, ==751.v709f84f7d768, ==752.vdddedf804e72, ==763.v13008816b_de7, ==766.v2b_e08c2e6ff2, ==776.vfee5327b_b_a_5b_, ==787.ve2fef0efdca_6, ==797.v90ea_a_9b_e45a_0

Summary

Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries

Details

Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries.

This allows attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.

Pipeline: Groovy Libraries Plugin 798.v5cc688825312 prohibits symbolic links in shared libraries.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types

==589.vb_a_b_4a_a_8c443c, ==591.v3a_7f422b_d058, ==593.595.vfc6485d13dcd, ==593.va_a_fc25d520e9, ==598.vcd66b_a_336510, ==612.614.v48dcb_f62a_640, ==612.v84da_9c54906d, ==613.v9c41a_160233f, ==621.vb_44ce045b_582, ==629.vb_5627b_ee2104, ==656.va_a_ceeb_6ffb_f7, ==671.v07c339c842e8, ==673.vb_c5d5948283c, ==685.v8ee9ed91d574, ==687.v62591d623759, ==689.veec561a_dee13, ==700.v0e341fa_57d53, ==704.vc58b_8890a_384, ==710.v4b_94b_077a_808, ==727.ve832a_9244dfa_, ==730.ve57b_34648c63, ==740.va_2701257fe8d, ==744.v5b_556ee7c253, ==745.vdf6077913de0, ==749.v70084559234a_, ==751.v709f84f7d768, ==752.vdddedf804e72, ==763.v13008816b_de7, ==766.v2b_e08c2e6ff2, ==776.vfee5327b_b_a_5b_, ==787.ve2fef0efdca_6, ==797.v90ea_a_9b_e45a_0, ==798.v5cc688825312, ==805.va_fc79344957d, ==806.v408277b_33d1d GHSA-2w2h-gwwj-fh3q

Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability

==589.vb_a_b_4a_a_8c443c, ==591.v3a_7f422b_d058, ==593.595.vfc6485d13dcd, ==593.va_a_fc25d520e9, ==598.vcd66b_a_336510, ==612.614.v48dcb_f62a_640, ==612.v84da_9c54906d, ==613.v9c41a_160233f, ==621.vb_44ce045b_582, ==629.vb_5627b_ee2104, ==656.va_a_ceeb_6ffb_f7, ==671.v07c339c842e8, ==673.vb_c5d5948283c, ==685.v8ee9ed91d574, ==687.v62591d623759, ==689.veec561a_dee13, ==700.v0e341fa_57d53, ==704.vc58b_8890a_384, ==710.v4b_94b_077a_808, ==727.ve832a_9244dfa_, ==730.ve57b_34648c63, ==740.va_2701257fe8d, ==744.v5b_556ee7c253, ==745.vdf6077913de0, ==749.v70084559234a_, ==751.v709f84f7d768, ==752.vdddedf804e72, ==763.v13008816b_de7, ==766.v2b_e08c2e6ff2, ==776.vfee5327b_b_a_5b_, ==787.ve2fef0efdca_6, ==797.v90ea_a_9b_e45a_0, ==798.v5cc688825312, ==805.va_fc79344957d, ==806.v408277b_33d1d GHSA-72c8-3wwg-r59w

Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin and Pipeline: Deprecated Groovy Libraries Plugin

==589.vb_a_b_4a_a_8c443c, ==591.v3a_7f422b_d058, ==593.595.vfc6485d13dcd, ==593.va_a_fc25d520e9, ==598.vcd66b_a_336510, ==612.614.v48dcb_f62a_640, ==612.v84da_9c54906d GHSA-4hjj-9gp7-4frg

Sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin

==589.vb_a_b_4a_a_8c443c, ==591.v3a_7f422b_d058, ==593.595.vfc6485d13dcd, ==593.va_a_fc25d520e9, ==598.vcd66b_a_336510, ==612.614.v48dcb_f62a_640, ==612.v84da_9c54906d GHSA-7qw2-h9gj-hcvh

View all vulnerabilities for these packages

Impacted packages

io.jenkins.plugins:pipeline-groovy-lib

Timeline

Published

4 months ago

Last Modified

2 months ago