| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | ≥ 2.122, < 2.138< 2.121.3 | 2.1382.121.3 |
| jenkins | ≤ 2.121.2≤ 2.137 |
A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free