Deserialization of Untrusted Data in Jenkins

中危 6.5CVE-2017-1000355 · GHSA-4466-8jm4-448p · Published 29/01/2018 · updated 17/06/2026

要点

CVE-2017-1000355 是影响 org.jenkins-ci.main:jenkins-core, jenkins (jenkins) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：1.7%，高于 77.8% 的漏洞。
修复：升级到 2.57, 2.46.2 或更高版本。

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 2.50, < 2.57< 2.46.2`	`2.572.46.2`
jenkins jenkins	`≤ 2.46.1≤ 2.56`	No fix yet

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

NVD description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Maven

≥ 2.50, < 2.57< 2.46.2

2.572.46.2

≤ 2.46.1≤ 2.56

No fix yet

Description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

NVD description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

org.jenkins-ci.main:jenkins-core 的其他漏洞

查看全部 →