A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pipeline:_groovy | Jenkins | * | 2.61 (including) |
| Red Hat OpenShift Container Platform 3.11 | RedHat | atomic-enterprise-service-catalog-1:3.11.82-1.git.1673.133961e.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | atomic-openshift-0:3.11.82-1.git.0.08bc31b.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | atomic-openshift-cluster-autoscaler-0:3.11.82-1.git.0.efb6af0.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | atomic-openshift-descheduler-0:3.11.82-1.git.300.89765c9.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | atomic-openshift-dockerregistry-0:3.11.82-1.git.452.0ce6383.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | atomic-openshift-metrics-server-0:3.11.82-1.git.52.2fdca3f.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | atomic-openshift-node-problem-detector-0:3.11.82-1.git.254.a448936.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | atomic-openshift-service-idler-0:3.11.82-1.git.14.e353758.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | atomic-openshift-web-console-0:3.11.82-1.git.355.5e8b1d9.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | golang-github-openshift-oauth-proxy-0:3.11.82-1.git.425.7cac034.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | golang-github-prometheus-alertmanager-0:3.11.82-1.git.0.3bf41ce.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | golang-github-prometheus-node_exporter-0:3.11.82-1.git.1063.48444e8.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | golang-github-prometheus-prometheus-0:3.11.82-1.git.5027.9d24833.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | haproxy-0:1.8.17-3.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | jenkins-0:2.150.2.1549032159-1.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | jenkins-2-plugins-0:3.11.1549642489-1.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | openshift-ansible-0:3.11.82-3.git.0.9718d0a.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | openshift-enterprise-autoheal-0:3.11.82-1.git.219.0b5aff4.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | openshift-enterprise-cluster-capacity-0:3.11.82-1.git.380.cf11c51.el7 | * |