CVE-2017-1000095

描述

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).

如何修補 CVE-2017-1000095

要修補 CVE-2017-1000095,請將受影響套件升級到下列已修補版本。

• —升級至 1.29.1 或更新版本

CVE-2017-1000095 正在被利用嗎?

低 — EPSS 為 0.8%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.29.1

CVSS 分數

參考連結(2)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2017-1000095
• WEBjenkins.io/security/advisory/2017-07-10