{"id":"CVE-2017-1000095","aliases":["EUVD-2022-4503","GHSA-m68x-cc2f-gr5h","RHEA-2017:1716"],"status":"published","title":"Unsafe methods in the default list of approved signatures in Jenkins Script Security Plugin","description":"The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00818,"percentile":0.57395,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2017-10-04T01:00:00Z","modified":"2026-10-24T10:30:44Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","fixed_in":["1.29.1"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:openshift:3.6::el7","package":"jenkins-plugin-script-security","fixed_in":["0:1.29-1.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.29"},{"fixed":"1.29.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:script-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1"}]}],"versions":["1.0","1.0-beta-1","1.0-beta-2","1.0-beta-3","1.0-beta-4","1.0-beta-5","1.0-beta-6","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.18.1","1.19","1.2","1.20","1.21","1.22","1.23","1.24","1.25","1.26","1.27","1.28","1.29","1.3","1.4","1.5","1.6","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"Red Hat:openshift:3.6::el7","package":"jenkins-plugin-script-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29-1.el7"}]}]}],"products":[{"vendor":"jenkins","product":"script_security"}],"references":[{"url":"https://jenkins.io/security/advisory/2017-07-10/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000095","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m68x-cc2f-gr5h"},{"url":"https://jenkins.io/security/advisory/2017-07-10","tags":["web"]},{"url":"https://access.redhat.com/errata/RHEA-2017:1716","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1275176","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1298750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1315962","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1365525","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1365867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1366795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1369914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1373441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374674","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1376022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1387149","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1390900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1392357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1392519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1393207","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1395079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1395547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1401134","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1402771","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1404860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1404959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1405307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1409878","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1414748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1414749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1415839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1420217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1420280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1421287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1421587","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1421623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1421643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1421738","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1421982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1421987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1422271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1422378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1425388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1425686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1426183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1427701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1427774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1428707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1428720","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1428934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1429314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1429364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1429368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1429398","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1431588","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1431655","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1431781","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1432281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1432389","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1433229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1435261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1435588","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1436391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1436536","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1436819","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1437193","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1437324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1438402","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1438762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1439142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1439451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1439619","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1440177","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1441755","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1441929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1442277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1442332","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1443187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1443533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1443687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1443765","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1444096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1444125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1444748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1444828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1445501","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1445504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1445526","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1446200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1446217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1446563","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1446627","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1446788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447115","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447207","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447588","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1447998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448944","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449058","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449320","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449589","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449908","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450286","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451008","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451192","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451693","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451927","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1452013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1452019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1452021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1452073","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1452092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1452367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1452442","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1452569","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1453078","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1453180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1454321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1454478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1454674","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1454948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455105","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455472","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455655","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455843","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1456093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1456139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1456144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1456156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1456413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1456490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1457062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1457510","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1457609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1457642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458653","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460871","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461662","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461664","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461771","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462067","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462087","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462345","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462446","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463055","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463131","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464550","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466622","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466680","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466703","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1467022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1467307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1467519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1467551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1467602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1467786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1467798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1467860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468113","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468572","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469633","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471040","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471881","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472741","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473587","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473953","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1474489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1474707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475131","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1476672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1476712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477326","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478198","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhea-2017_1716.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000095","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-1000095","description":"The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).","status":"published","published":"2017-10-04T01:00:00Z","modified":"2024-08-05T21:53:06.664Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2022-4503","description":"The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).","status":"published","published":"2017-10-04T01:00:00Z","modified":"2024-08-05T21:53:06Z","updated_at":"2026-11-03T02:23:03.593375Z"}],"ghsa":[{"id":"GHSA-m68x-cc2f-gr5h","title":"Unsafe methods in the default list of approved signatures in Jenkins Script Security Plugin","description":"The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).","status":"published","published":"2022-05-13T01:40:54Z","modified":"2024-01-30T22:46:08Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:37:33.621286Z"}],"nvd":[{"id":"CVE-2017-1000095","description":"The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).","status":"published","published":"2017-10-05T01:29:03.883Z","modified":"2026-06-17T00:58:43.61Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:04:01.734197Z"}],"osv":[{"id":"CVE-2017-1000095","description":"The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).","status":"published","published":"2017-10-05T01:29:03.883Z","modified":"2026-10-24T10:30:44.582338611Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"GHSA-m68x-cc2f-gr5h","title":"Unsafe methods in the default list of approved signatures in Jenkins Script Security Plugin","description":"The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).","status":"published","published":"2022-05-13T01:40:54Z","modified":"2024-02-18T05:32:27.070009Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"RHEA-2017:1716","title":"Red Hat Enhancement Advisory: Red Hat OpenShift Container Platform 3.6 RPM Release Advisory","status":"published","published":"2024-09-16T00:19:17Z","modified":"2026-05-13T10:35:33.880922Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"}]}}