Creation of Chained Constructor Invocation Affecting org.jenkins-ci.plugins:script-security package, versions [0,]
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-6807578
- published 3 May 2024
- disclosed 3 May 2024
- credit Devin Nusbaum
Introduced: 3 May 2024
CVE-2024-34145 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users.
Affected versions of this package are vulnerable to Creation of Chained Constructor Invocation due to sandbox-defined Groovy classes that shadow specific non-sandbox-defined classes can be used to construct any subclassable type.
Notes:
These issues are caused by an incomplete fix of SECURITY-2824
This vulnerability is fixed in Script Security Plugin 1336.vf33a_a_9863911.