Jenkins Kubernetes Pipeline vulnerabilities

2 CVEs affecting Jenkins Kubernetes Pipeline, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-10418, published 2019-09-25.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-10418, published 2019-09-25. Critical severity, CVSS 9.9. EPSS: 1.2% chance of exploitation in the next 30 days. Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
• CVE-2019-10417, published 2019-09-25. Critical severity, CVSS 9.9. EPSS: 1.2% chance of exploitation in the next 30 days. Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.