A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM

Affected: Maven: org.jenkins-ci.plugins.workflow:workflow-cps, Maven: org.jenkins-ci.plugins:script-security

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM

haproxy: Out-of-bounds read in dns.c:dns_validate_dns_response() allows for memory disclosure haproxy: Infinite recursion via crafted packet allows stack exhaustion and denial of service haproxy: Mishandling of priority flag in short HEADERS frame by HTTP/2 decoder allows for crash jenkins-plugin-script-security: Sandbox Bypass in finalize methods jenkins-plugin-script-security: Sandbox Bypass in finalize methods prometheus: Stored DOM cross-site scripting (XSS) attack via crafted URL jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin jenkins-plugin-workflow-cps: Sandbox Bypass in Pipeline: Groovy Plugin jenkins-plugin-pipeline-model-definition: Sandbox Bypass in Pipeline: Declarative jenkins: cookie crafted using Jenkins script console allows unauthorised access to Jenkins instance jenkins: deleting a user record will does not invalidate existing sessions jenkins-plugin-git: CSRF vulnerability in Git Plugin (SECURITY-1095) jenkins-plugin-token-macro: Recursive token expansion results in information disclosure and DoS in Token Macro Plugin (SECURITY-1102) jenkins-plugin-blueocean: Blue Ocean did not require CSRF tokens (SECURITY-1201) jenkins-plugin-blueocean: XSS vulnerability via user description in Blue Ocean (SECURITY-1204) jenkins-plugin-config-file-provider: Stored XSS vulnerability in Config File Provider Plugin (SECURITY-1253)