| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.main:cli | ≥ 1.626, < 1.638< 1.625.2 | 1.6381.625.2 |
| jenkins | < 1.625.2< 1.638 | 1.625.21.638 |
| openshift container platform | = 2.2= 3.1 |
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in ysoserial".
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free