The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins LTS to version 1.625.2Upgrade Jenkins to version 1.638Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest version | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade nodejs-xdg-basedirUpgrade nodejs-os-homedirUpgrade nodejs-ansi-greenUpgrade nodejs-object.omitUpgrade nodejs-strip-json-commentsUpgrade nodejs-undefsafeUpgrade nodejs-map-streamUpgrade nodejs-is-primitiveUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-async-eachUpgrade nodejs-os-tmpdirUpgrade nodejs-extglobUpgrade nodejs-duplexifyUpgrade nodejs-rcUpgrade nodejs-osenvUpgrade nodejs-expand-rangeUpgrade nodejs-gotUpgrade nodejs-is-streamUpgrade nodejs-is-numberUpgrade nodejs-regex-cacheUpgrade nodejs-capture-stack-traceUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-lowercase-keysUpgrade nodejs-fromUpgrade openshift-origin-cartridge-cronUpgrade nodejs-pinkieUpgrade phpUpgrade nodejs-is-dotfileUpgrade nodejs-create-error-classUpgrade nodejs-stream-combinerUpgrade nodejs-node-status-codesUpgrade openshift-enterprise-upgradeUpgrade openvswitchUpgrade nodejs-lodash.assignUpgrade nodejs-write-file-atomicUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-glob-parentUpgrade nodejs-arr-diffUpgrade nodejs-configstoreUpgrade nodejs-array-uniqueUpgrade nodejs-latest-versionUpgrade nodejs-is-globUpgrade nodejs-error-exUpgrade nodejs-align-textUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-lodash.isargumentsUpgrade nodejs-kind-ofUpgrade openshift-origin-node-utilUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-pause-streamUpgrade nodejs-optimistUpgrade nodejs-ps-treeUpgrade nodejs-binary-extensionsUpgrade nodejs-throughUpgrade openshift-origin-broker-utilUpgrade nodejs-isobjectUpgrade nodejs-registry-urlUpgrade nodejs-anymatchUpgrade origin-kibanaUpgrade nodejs-update-notifierUpgrade nodejs-es6-promiseUpgrade nodejs-lazy-cacheUpgrade nodejs-repeat-elementUpgrade nodejs-unzip-responseUpgrade rubygem-openshift-origin-commonUpgrade nodejs-is-redirectUpgrade nodejs-url-parse-laxUpgrade jenkinsUpgrade nodejs-expand-bracketsUpgrade nodejs-arr-flattenUpgrade nodejs-lodash.restparamUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-is-equal-shallowUpgrade nodejs-graceful-fsUpgrade openshift-origin-cartridge-pythonUpgrade atomic-openshiftUpgrade nodejs-ansi-wrapUpgrade nodejs-touchUpgrade nodejs-glob-baseUpgrade nodejs-mkdirpUpgrade nodejs-is-extendableUpgrade nodejs-slideUpgrade nodejs-prepend-httpUpgrade nodejs-randomaticUpgrade nodejs-lodash.defaultsUpgrade nodejs-for-inUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-fill-rangeUpgrade nodejs-chokidarUpgrade nodejs-object-assignUpgrade nodejs-lodash.isiterateecallUpgrade openshift-origin-node-proxyUpgrade nodejs-lodash.basecopyUpgrade nodejs-lodash.isarrayUpgrade nodejs-normalize-pathUpgrade nodejs-timed-outUpgrade nodejs-lodash.getnativeUpgrade nodejs-duplexerUpgrade nodejs-parse-jsonUpgrade nodejs-success-symbolUpgrade nodejs-micromatchUpgrade nodejs-is-binary-pathUpgrade heapsterUpgrade nodejs-parse-globUpgrade nodejs-semverUpgrade nodejs-splitUpgrade nodejs-string-lengthUpgrade nodejs-uuidUpgrade nodejs-nodemonUpgrade nodejs-lodash.keysUpgrade nodejs-pinkie-promiseUpgrade rubygem-openshift-origin-consoleUpgrade openshift-origin-cartridge-phpUpgrade nodejs-filename-regexUpgrade nodejs-semver-diffUpgrade nodejs-for-ownUpgrade nodejs-readdirpUpgrade nodejs-package-jsonUpgrade openshift-ansibleUpgrade nodejs-iniUpgrade nss_wrapperUpgrade nodejs-is-npmUpgrade nodejs-bracesUpgrade nodejs-arrifyUpgrade nodejs-lodash.createassignerUpgrade nodejs-end-of-streamUpgrade nodejs-lodash.baseassignUpgrade nodejs-is-extglobUpgrade nodejs-read-all-streamUpgrade nodejs-is-plain-objUpgrade nodejs-preserveUpgrade nodejs-event-streamUpgrade nodejs-deep-extendUpgrade rhcUpgrade activemq | Jun 18, 2018 | Nov 11, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub