CVE-2017-1000353

Jenkins Remote Code Execution Vulnerability

Jenkins

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also…

29. Jan 2018

Ausgewertete Quellen

• Hersteller
  https://jenkins.io/security/advisory/2017-04-26/
• Hinweis
  http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.html
• Hinweis
  https://www.exploit-db.com/exploits/41965/
• Hinweis
  https://www.oracle.com/security-alerts/cpuapr2022.html
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000353
• CISA
  Jenkins Remote Code Execution Vulnerability
• NVD
  CVE-2017-1000353