The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins LTS to version 1.625.2Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest versionUpgrade Jenkins to version 1.638 | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade nodejs-mkdirpUpgrade phpUpgrade nodejs-es6-promiseUpgrade nodejs-uuidUpgrade nodejs-parse-globUpgrade nodejs-strip-json-commentsUpgrade nodejs-is-redirectUpgrade nodejs-optimistUpgrade openshift-origin-cartridge-cronUpgrade nodejs-ansi-greenUpgrade nodejs-readdirpUpgrade nodejs-extglobUpgrade nodejs-lodash.getnativeUpgrade nodejs-iniUpgrade nodejs-touchUpgrade nodejs-arr-diffUpgrade nodejs-create-error-classUpgrade nodejs-repeat-elementUpgrade nodejs-regex-cacheUpgrade nodejs-map-streamUpgrade nodejs-arrifyUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-lodash.assignUpgrade activemqUpgrade nodejs-deep-extendUpgrade openvswitchUpgrade nodejs-is-extglobUpgrade origin-kibanaUpgrade nodejs-pause-streamUpgrade nodejs-is-plain-objUpgrade nodejs-read-all-streamUpgrade nodejs-url-parse-laxUpgrade nodejs-undefsafeUpgrade nodejs-throughUpgrade nodejs-lodash.defaultsUpgrade nodejs-is-primitiveUpgrade nodejs-anymatchUpgrade nodejs-is-streamUpgrade nodejs-rcUpgrade openshift-enterprise-upgradeUpgrade nodejs-pinkieUpgrade nodejs-filename-regexUpgrade nodejs-write-file-atomicUpgrade nodejs-event-streamUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-stream-combinerUpgrade nodejs-is-equal-shallowUpgrade nodejs-latest-versionUpgrade nodejs-object.omitUpgrade nodejs-preserveUpgrade nodejs-duplexerUpgrade nodejs-kind-ofUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-duplexifyUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-lodash.isargumentsUpgrade nodejs-configstoreUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-nodemonUpgrade nodejs-semverUpgrade nodejs-arr-flattenUpgrade nodejs-osenvUpgrade nodejs-async-eachUpgrade nodejs-splitUpgrade nodejs-glob-baseUpgrade nodejs-graceful-fsUpgrade nodejs-gotUpgrade nodejs-expand-rangeUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-is-dotfileUpgrade nodejs-end-of-streamUpgrade nodejs-bracesUpgrade nodejs-for-inUpgrade nodejs-unzip-responseUpgrade rubygem-openshift-origin-commonUpgrade openshift-origin-node-proxyUpgrade nodejs-lodash.basecopyUpgrade nodejs-timed-outUpgrade openshift-origin-cartridge-phpUpgrade nodejs-pinkie-promiseUpgrade nodejs-slideUpgrade nodejs-prepend-httpUpgrade nodejs-os-tmpdirUpgrade nodejs-package-jsonUpgrade nodejs-error-exUpgrade nodejs-micromatchUpgrade nodejs-is-extendableUpgrade nodejs-lodash.createassignerUpgrade nodejs-lodash.restparamUpgrade nodejs-isobjectUpgrade nodejs-lazy-cacheUpgrade atomic-openshiftUpgrade nodejs-expand-bracketsUpgrade heapsterUpgrade openshift-origin-node-utilUpgrade openshift-origin-broker-utilUpgrade rhcUpgrade nodejs-object-assignUpgrade nodejs-update-notifierUpgrade nodejs-is-npmUpgrade nodejs-randomaticUpgrade nodejs-chokidarUpgrade nodejs-success-symbolUpgrade nodejs-lowercase-keysUpgrade nodejs-string-lengthUpgrade nodejs-capture-stack-traceUpgrade nodejs-ansi-wrapUpgrade nodejs-lodash.baseassignUpgrade jenkinsUpgrade nodejs-lodash.keysUpgrade nodejs-fromUpgrade nss_wrapperUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-normalize-pathUpgrade nodejs-is-globUpgrade nodejs-is-binary-pathUpgrade nodejs-ps-treeUpgrade nodejs-registry-urlUpgrade openshift-ansibleUpgrade nodejs-align-textUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-for-ownUpgrade nodejs-xdg-basedirUpgrade nodejs-os-homedirUpgrade nodejs-semver-diffUpgrade nodejs-parse-jsonUpgrade nodejs-array-uniqueUpgrade nodejs-binary-extensionsUpgrade nodejs-lodash.isarrayUpgrade nodejs-glob-parentUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-fill-rangeUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-node-status-codesUpgrade nodejs-is-number | Jun 18, 2018 | Nov 11, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub