Deserialization of Untrusted Data in Jenkins

MOYENNE 6.5CVE-2017-1000355 · GHSA-4466-8jm4-448p · Published 29/01/2018 · updated 17/06/2026

En bref

CVE-2017-1000355 est une vulnérabilité MOYENNE (CVSS 6.5) touchant org.jenkins-ci.main:jenkins-core, jenkins (jenkins).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.7%, plus élevée que 77.8% des vulnérabilités.
Correctif : mettre à jour vers 2.57, 2.46.2 ou plus récent.

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 2.50, < 2.57< 2.46.2`	`2.572.46.2`
jenkins jenkins	`≤ 2.46.1≤ 2.56`	No fix yet

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

NVD description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Maven

≥ 2.50, < 2.57< 2.46.2

2.572.46.2

≤ 2.46.1≤ 2.56

No fix yet

Description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

NVD description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

Autres vulnérabilités de org.jenkins-ci.main:jenkins-core

Tout voir →