Maven/org.jenkins-ci.plugins.workflow:workflow-cps CVE-2018-1000866: high 8.8, EPSS 1.64%

Jenkins Script Security and Pipeline Groovy Plugins Sandbox Bypass

Action: Upgrade org.jenkins-ci.plugins.workflow:workflow-cps to 2.60 or later.

Affected

Fixed versions

Sources

• osv: GHSA-gqhm-4h93-rrhg
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000866
• https://github.com/jenkinsci/script-security-plugin/commit/16c862ae9d4038a3edbd8bdfb0fd1401a509d56b
• https://github.com/jenkinsci/workflow-cps-plugin/commit/0eb89aaf24065dbbdf6db84516ac1a52cd435e6d
• https://github.com/jenkinsci/workflow-cps-plugin/commit/e1c56eb6d85d513cb24dfe188e6f592d0ff84b38
• https://access.redhat.com/errata/RHBA-2019:0326
• https://access.redhat.com/errata/RHBA-2019:0327
• https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186

CVE-2018-1000866 · published 2022-05-13T01:48:40Z · modified 2024-02-16T08:05:23.464110Z · JSON