CVE-2019-1003029

CVE-2019-1003029 is a sandbox bypass in the Jenkins Script Security Plugin (versions 1.53 and earlier) in GroovySandbox.java and SecureGroovyScript.java, allowing Groovy scripts that are supposed to be restricted by the sandbox to escape its protections. A remote attacker who has Overall/Read permission on a Jenkins instance can trigger the flaw and execute arbitrary code in the Jenkins master JVM, gaining high-impact access to the controller and, per the CVSS scope change, to resources it manages. Any Jenkins deployment running the affected plugin versions is exposed, including the Jenkins components bundled with Red Hat OpenShift Container Platform. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-25, and EPSS estimates a 73.9% probability of exploitation within 30 days (99th percentile), though no public proof-of-concept is known and ransomware use is unconfirmed.

What to do: Upgrade the Script Security Plugin to version 1.54 or later (the first release after the affected 1.53), and apply the corresponding Jenkins updates in Red Hat OpenShift Container Platform per Red Hat's instructions. As interim mitigation, restrict Overall/Read access to untrusted users and limit who can submit or define sandboxed Groovy scripts. Confirm the update on any Jenkins instance in your environment, prioritizing internet-exposed controllers, since the flaw is on CISA's KEV list.