GHSA-7VR5-72W7-Q6JC Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin

Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be...

GHSA-4HJJ-9GP7-4FRG Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin and Pipeline: Deprecated Groovy Libraries Plugin

Pipeline: Groovy Libraries Plugin and older releases of the Pipeline: Deprecated Groovy Libraries Plugin formerly Pipeline: Shared Groovy Libraries Plugin define the library Pipeline step, which allows Pipeline authors to dynamically load Pipeline libraries. The return value of this step can be...

org.jenkins-ci.plugins.pipeline-stage-view:parent-pom (1.0), org.jenkins-ci.plugins.pipeline-stage-view:pipeline-rest-api (1.0) +2 more potentially affected by CVE-2022-43405 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.14)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: -...

org.jenkins-ci.plugins.pipeline-stage-view:parent-pom (>=1.0-alpha-1, <=1.0-alpha-2), org.jenkins-ci.plugins.pipeline-stage-view:pipeline-rest-api (>=1.0-alpha-1, <=1.0-alpha-2) +2 more potentially affected by CVE-2022-43406 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.14-beta-1)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.14-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: -...

com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.15) +1 more potentially affected by CVE-2022-43406 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.15)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - com.qasymphony.ci.jenkins:qtest =1.3.0, =1.0.4,...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.2), org.jenkins-ci.plugins:token-macro (2.2) +1 more potentially affected by CVE-2022-43406 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

com.testinium.jenkins:testinium (1.0), org.jenkins-ci.plugins.workflow:workflow-aggregator (2.5) +9 more potentially affected by CVE-2022-43406 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.5)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - com.testinium.jenkins:testinium 1.0 -...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.10), org.jenkins-ci.plugins:pipeline-editor (1.0-alpha-1) potentially affected by CVE-2022-43406 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.10)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregato...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0, <=2.2), org.jenkins-ci.plugins:token-macro (2.2) +1 more potentially affected by CVE-2022-43405 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.0)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator...

io.jenkins.plugins:tricentis-ci (>=1.0, <=1.3), org.jenkins-ci.plugins.workflow:workflow-cps (>=2.37, <=2.38) +3 more potentially affected by CVE-2022-43401 via org.jenkins-ci.plugins:script-security (1.30)

org.jenkins-ci.plugins:script-security MAVEN version 1.30 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:tricentis-ci =1.0, =2.37, =1.22-beta-1, =1.10, =1.5, =1.6 Source...

org.jenkins-ci.plugins:pipeline-utility-steps (>=1.4.0, <=1.5.1) potentially affected by CVE-2022-43401 via org.jenkins-ci.plugins:script-security (1.29.1)

org.jenkins-ci.plugins:script-security MAVEN version 1.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:pipeline-utility-steps =1.4.0, =1.5.1 Source cves:...

org.jenkins-ci.plugins.workflow:workflow-cps (>=2.40, <=2.41), org.jenkins-ci.plugins:claim (>=2.10, <=2.15) +3 more potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins:script-security (1.34)

org.jenkins-ci.plugins:script-security MAVEN version 1.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps =2.40, =2.10, =1.7, =1.2.5, =1.2.5,...

hudson.plugins.octopusdeploy:octopusdeploy (4.0.2), org.jenkins-ci.plugins:badge (>=1.0, <=1.1) +2 more potentially affected by CVE-2022-43403 via org.jenkins-ci.plugins:script-security (1.39)

org.jenkins-ci.plugins:script-security MAVEN version 1.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - hudson.plugins.octopusdeploy:octopusdeploy 4.0.2 - org.jenkins-ci.plugins:badge =1.0...

org.jenkins-ci.plugins:extreme-notification (>=1.5, <=1.6), org.jenkins-ci.plugins:junit-realtime-test-reporter (>=0.5, <=0.6) +1 more potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins:script-security (1.33)

org.jenkins-ci.plugins:script-security MAVEN version 1.33 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:extreme-notification =1.5, =0.5, =3.4.0-beta-1, =3.5.12 Sourc...

org.jenkins-ci.plugins.pipeline-stage-view:parent-pom (>=1.0-alpha-1, <=1.0-alpha-2), org.jenkins-ci.plugins.pipeline-stage-view:pipeline-rest-api (>=1.0-alpha-1, <=1.0-alpha-2) +2 more potentially affected by CVE-2022-43405 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.14-beta-1)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.14-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: -...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.10), org.jenkins-ci.plugins:pipeline-editor (1.0-alpha-1) potentially affected by CVE-2022-43405 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.10)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregato...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.13) +4 more potentially affected by CVE-2022-43405 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.13)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - com.btc.ep:btc-embeddedplatform =1.9.2-beta,...

io.jenkins.blueocean:blueocean (>=1.0.0-b15, <=1.0.0-b21), io.jenkins.blueocean:blueocean-github-pipeline (>=1.0.0-b15, <=1.0.0-b21) +7 more potentially affected by CVE-2022-43406 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.3)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b15,...

com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.15) +1 more potentially affected by CVE-2022-43405 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.15)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - com.qasymphony.ci.jenkins:qtest =1.3.0, =1.0.4,...

org.jenkins-ci.plugins:pipeline-utility-steps (>=1.4.0, <=1.5.1) potentially affected by CVE-2022-43403 via org.jenkins-ci.plugins:script-security (1.29.1)

org.jenkins-ci.plugins:script-security MAVEN version 1.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:pipeline-utility-steps =1.4.0, =1.5.1 Source cves:...