CVE-2017-1000095
mediumpriority · track · 26EPSS 0.008 · 57 %ileEUUSEPSS · scored 2026-10-27
The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedjenkins-plugin-script-security-0:1.29-1.el7.src as a component of Red Hat OpenShift Container Platform 3.6redhat_csaf
Before applying this update, ensure all previously released errata relevant to your system have been applied. For instructions on new installations, see the following documentation: https://docs.openshift.com/container-platform/3.6/install_config/install/planning.html For instructions on how to properly upgrade existing clusters to OpenShift Container Platform 3.6, see the following documentation: https://docs.openshift.com/container-platform/3.6/install_config/upgrading/index.html
https://access.redhat.com/errata/RHEA-2017:1716 - Fixedjenkins-plugin-script-security-0:1.29-1.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.6redhat_csaf
Before applying this update, ensure all previously released errata relevant to your system have been applied. For instructions on new installations, see the following documentation: https://docs.openshift.com/container-platform/3.6/install_config/install/planning.html For instructions on how to properly upgrade existing clusters to OpenShift Container Platform 3.6, see the following documentation: https://docs.openshift.com/container-platform/3.6/install_config/upgrading/index.html
https://access.redhat.com/errata/RHEA-2017:1716
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4–8.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (897)
Products and version ranges known to be affected.
- Maven org.jenkins-ci.plugins:script-security< 1.29.1osvUSpkg:maven/org.jenkins-ci.plugins/script-security
- apb-0:0.1.2-1.el7.noarch as a component of Red Hat OpenShift Container Platform 3.6all versionsnot affectedredhat_csafUS
- apb-0:0.1.2-1.el7.src as a component of Red Hat OpenShift Container Platform 3.6all versionsnot affectedredhat_csafUS
advisories (2)
Vendor and ecosystem advisories describing this.
- RHEA-2017:1716Red Hat Enhancement Advisory: Red Hat OpenShift Container Platform 3.6 RPM Release Advisory2017-08-10csaf · redhat_csafUS
Red Hat OpenShift Container Platform 3.6, which fixes several bugs and includes various enhancements, is now available.
- GHSA-m68x-cc2f-gr5hUnsafe methods in the default list of approved signatures in Jenkins Script Security Plugin2022-05-13ghsa · osvUS
The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (3)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan