Improper Neutralization of Special Elements used in an LDAP Query in Jenkins

CRITICAL 9.8CVE-2016-9299 · GHSA-2x9h-h3c4-wqqh · Published 12/01/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 2.20, < 2.32< 2.19.3`	`2.322.19.3`
jenkins jenkins	`≤ 2.19.2≤ 2.31`	No fix yet

Description

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-9299 · ADVISORY
jenkinsci/jenkins commit 6078dd7 · WEB
jenkinsci/jenkins commit ce8a2d5 · WEB
jenkinsci/jenkins commit d84d9a2 · WEB
jenkinsci/jenkins commit f574224 · WEB
jenkinsci/jenkins commit fde9c42 · WEB
jenkinsci/jenkins · PACKAGE
groups.google.com/forum · WEB
groups.google.com/forum · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/ZW2KUKYLNLVDB7STLHLYALCUFLEGCRM6 · WEB
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16 · WEB
cloudbees.com/jenkins-security-advisory-2016-11-16 · WEB
exploit-db.com/exploits/44642 · WEB
openwall.com/lists/oss-security/2016/11/12/4 · WEB
openwall.com/lists/oss-security/2016/11/14/9 · WEB
slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition · WEB
securityfocus.com/bid/94281 · Third Party Advisory
groups.google.com/forum
groups.google.com/forum
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW2KUKYLNLVDB7STLHLYALCUFLEGCRM6
exploit-db.com/exploits/44642 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free