Improper Neutralization of Special Elements used in an LDAP Query in Jenkins

NGHIÊM TRỌNG 9.8CVE-2016-9299 · GHSA-2x9h-h3c4-wqqh · Công bố 12/01/2017 · cập nhật 17/06/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.jenkins-ci.main:jenkins-core Maven	`≥ 2.20, < 2.32< 2.19.3`	`2.322.19.3`
jenkins jenkins	`≤ 2.19.2≤ 2.31`	Chưa có bản vá

Mô tả

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

Mô tả của NVD

Tham khảo

nvd.nist.gov/vuln/detail/CVE-2016-9299 · ADVISORY
jenkinsci/jenkins commit 6078dd7 · WEB
jenkinsci/jenkins commit ce8a2d5 · WEB
jenkinsci/jenkins commit d84d9a2 · WEB
jenkinsci/jenkins commit f574224 · WEB
jenkinsci/jenkins commit fde9c42 · WEB
jenkinsci/jenkins · PACKAGE
groups.google.com/forum · WEB
groups.google.com/forum · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/ZW2KUKYLNLVDB7STLHLYALCUFLEGCRM6 · WEB
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16 · WEB
cloudbees.com/jenkins-security-advisory-2016-11-16 · WEB
exploit-db.com/exploits/44642 · WEB
openwall.com/lists/oss-security/2016/11/12/4 · WEB
openwall.com/lists/oss-security/2016/11/14/9 · WEB
slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition · WEB
securityfocus.com/bid/94281 · Third Party Advisory
groups.google.com/forum
groups.google.com/forum
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW2KUKYLNLVDB7STLHLYALCUFLEGCRM6
exploit-db.com/exploits/44642 · Third Party Advisory

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí