| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | ≥ 2.320, < 2.334< 2.319.3 | 2.3342.319.3 |
| jenkins | < 2.319.3< 2.334 | 2.319.32.334 |
Jenkins 2.333 and earlier, LTS 2.319.2 and earlier is affected by the XStream library’s vulnerability CVE-2021-43859. This library is used by Jenkins to serialize and deserialize various XML files, like global and job config.xml, build.xml, and numerous others.
This allows attackers able to submit crafted XML files to Jenkins to be parsed as configuration, e.g. through the POST config.xml API, to cause a denial of service (DoS).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free