Deserialization of Untrusted Data in Jenkins

MEDIO 6.5CVE-2017-1000355 · GHSA-4466-8jm4-448p · Published 29/01/2018 · updated 17/06/2026

En resumen

CVE-2017-1000355 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a org.jenkins-ci.main:jenkins-core, jenkins (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.7%, mayor que el 77.8% de las vulnerabilidades.
Solución: actualizar a 2.57, 2.46.2 o posterior.

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 2.50, < 2.57< 2.46.2`	`2.572.46.2`
jenkins jenkins	`≤ 2.46.1≤ 2.56`	No fix yet

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

NVD description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Maven

≥ 2.50, < 2.57< 2.46.2

2.572.46.2

≤ 2.46.1≤ 2.56

No fix yet

Description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

NVD description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

Más vulnerabilidades de org.jenkins-ci.main:jenkins-core

Ver todo →