CVE-2019-1003041 Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin

What is CVE-2019-1003041?

CVE-2019-1003041 is a critical vulnerability in Redhat Openshift Container Platform, published on 28 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

Weakness: CWE-470

Which versions are affected by CVE-2019-1003041?

2 open source packages ship an affected version, including org.jenkins-ci.plugins.workflow:workflow-cps. It affects 2 products.

Products include Jenkins Pipeline\, Redhat Openshift Container Platform.

How do I fix CVE-2019-1003041?

Upgrade org.jenkins-ci.plugins.workflow:workflow-cps to 2.65 or later.

Is CVE-2019-1003041 being exploited?

There is no known exploitation of CVE-2019-1003041 in the wild and no public exploit code.

Other vulnerabilities in Redhat Openshift Container Platform

• CVE-2019-1003030 Jenkins Matrix Project Plugin Remote Code Execution Exploited Critical 9.9
• CVE-2022-43402 Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution Critical 9.9
• CVE-2022-43407 CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin High 8.8
• CVE-2022-25173 Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Groovy Plugin High 8.8
• CVE-2022-25174 Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Shared Groovy Libraries Plugin High 8.8

All Redhat Openshift Container Platform vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x74x-qf5j-35jh.