VYPR
← All advisories
Critical severityNVD Advisory· Published May 31, 2019· Updated Aug 4, 2024

CVE-2019-10328

CVE-2019-10328

Description

Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.plugins:workflow-remote-loaderMaven
< 1.51.5

Affected products

1

Patches

1
6f9d60f61435

[SECURITY-921]

https://github.com/jenkinsci/workflow-remote-loader-pluginEmilio EscobarMay 27, 2019via ghsa
commit
2 files changed · +0 −14
  • src/main/java/org/jenkinsci/plugins/workflow/remoteloader/FileLoaderDSL.java+0 −12 modified
    @@ -61,16 +61,4 @@ public static String getSampleSnippet(String name) throws IOException {
         return IOUtils.toString(scriptStream, "UTF-8");
     }
     
-    @Extension
-    public static class MiscWhitelist extends ProxyWhitelist {
-
-        public MiscWhitelist() throws IOException {
-            super(new StaticWhitelist(
-                    "new java.util.TreeMap",
-                    "method groovy.lang.Closure call java.lang.Object",
-                    "method java.lang.Object toString",
-                    "method groovy.lang.GroovyObject invokeMethod java.lang.String java.lang.Object"
-            ));
-        }
-    }
 }
  • src/main/resources/org/jenkinsci/plugins/workflow/remoteloader/FileLoaderDSL/FileLoaderDSLImpl.groovy+0 −2 modified
    @@ -50,7 +50,6 @@ class FileLoaderDSLImpl implements Serializable {
   
   public <V> V withGit(String repoUrl = DEFAULT_REPO_URL, String repoBranch = DEFAULT_BRANCH, 
         String credentialsId = null, labelExpression = '', Closure<V> body) {
-    Map<String, Object> loaded = new TreeMap<String, Object>()
     node(labelExpression) {
       withTimestamper {
         script.dir(TMP_FOLDER) {
@@ -83,7 +82,6 @@ class FileLoaderDSLImpl implements Serializable {
   
   public <V> V withSVN(String repoUrl = DEFAULT_REPO_URL,  
         String credentialsId = null, labelExpression = '', Closure<V> body) {
-    Map<String, Object> loaded = new TreeMap<String, Object>()
     node(labelExpression) {
       withTimestamper {
         script.dir(TMP_FOLDER) {

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.