What it is
Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other Jenkins entries on the list
- Jenkins Command Line Interface (CLI) Jenkins Command Line Interface (CLI) Path Traversal Vulnerability CVE-2024-23897 · Aug 19, 2024
- Jenkins User Interface (UI) Jenkins User Interface (UI) Information Disclosure Vulnerability CVE-2015-5317 · May 12, 2023
- Script Security Plugin Jenkins Script Security Plugin Sandbox Bypass Vulnerability CVE-2019-1003029 · Apr 25, 2022
- Matrix Project Plugin Jenkins Matrix Project Plugin Remote Code Execution Vulnerability CVE-2019-1003030 · Mar 25, 2022
- Jenkins Stapler Web Framework Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability CVE-2018-1000861 · Feb 10, 2022