The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins LTS to version 1.625.2Upgrade Jenkins to version 1.638Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest version | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade nodejs-touchUpgrade nodejs-configstoreUpgrade nodejs-undefsafeUpgrade nodejs-expand-rangeUpgrade openvswitchUpgrade openshift-origin-cartridge-cronUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-nodemonUpgrade nodejs-arr-diffUpgrade nodejs-extglobUpgrade nodejs-pinkieUpgrade nodejs-is-equal-shallowUpgrade nodejs-throughUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-lodash.defaultsUpgrade nodejs-readdirpUpgrade nodejs-event-streamUpgrade nodejs-arr-flattenUpgrade nodejs-lodash.isargumentsUpgrade nodejs-is-redirectUpgrade nodejs-filename-regexUpgrade nodejs-stream-combinerUpgrade phpUpgrade nodejs-url-parse-laxUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-is-extglobUpgrade nodejs-is-streamUpgrade nodejs-duplexerUpgrade nodejs-is-primitiveUpgrade origin-kibanaUpgrade nodejs-duplexifyUpgrade nodejs-pause-streamUpgrade activemqUpgrade nodejs-optimistUpgrade nodejs-write-file-atomicUpgrade nodejs-repeat-elementUpgrade rubygem-openshift-origin-consoleUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-ansi-greenUpgrade nodejs-lodash.assignUpgrade nodejs-create-error-classUpgrade nodejs-parse-globUpgrade nodejs-read-all-streamUpgrade nodejs-preserveUpgrade nodejs-async-eachUpgrade nodejs-deep-extendUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-lodash.getnativeUpgrade nodejs-osenvUpgrade nodejs-graceful-fsUpgrade openshift-enterprise-upgradeUpgrade nodejs-uuidUpgrade nodejs-regex-cacheUpgrade nodejs-arrifyUpgrade nodejs-rcUpgrade nodejs-latest-versionUpgrade nodejs-splitUpgrade nodejs-mkdirpUpgrade nodejs-semverUpgrade nodejs-kind-ofUpgrade nodejs-anymatchUpgrade nodejs-gotUpgrade nodejs-es6-promiseUpgrade nodejs-object.omitUpgrade nodejs-map-streamUpgrade nodejs-glob-baseUpgrade nodejs-iniUpgrade nodejs-strip-json-commentsUpgrade nodejs-is-plain-objUpgrade nodejs-ps-treeUpgrade nodejs-lodash.isarrayUpgrade nodejs-os-homedirUpgrade nodejs-object-assignUpgrade nodejs-lodash.createassignerUpgrade nodejs-xdg-basedirUpgrade nodejs-end-of-streamUpgrade nodejs-fromUpgrade nodejs-os-tmpdirUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-lowercase-keysUpgrade nodejs-is-extendableUpgrade nodejs-align-textUpgrade jenkinsUpgrade nodejs-micromatchUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-package-jsonUpgrade nodejs-capture-stack-traceUpgrade nodejs-randomaticUpgrade nodejs-binary-extensionsUpgrade nodejs-parse-jsonUpgrade nodejs-unzip-responseUpgrade nodejs-pinkie-promiseUpgrade nodejs-bracesUpgrade nodejs-semver-diffUpgrade rubygem-openshift-origin-commonUpgrade nodejs-normalize-pathUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-update-notifierUpgrade nodejs-string-lengthUpgrade nodejs-is-numberUpgrade nodejs-timed-outUpgrade nodejs-lodash.basecopyUpgrade atomic-openshiftUpgrade openshift-origin-cartridge-phpUpgrade nodejs-is-dotfileUpgrade nodejs-lodash.restparamUpgrade nodejs-success-symbolUpgrade nodejs-prepend-httpUpgrade nodejs-for-ownUpgrade nodejs-is-npmUpgrade nodejs-ansi-wrapUpgrade nodejs-lodash.baseassignUpgrade nodejs-array-uniqueUpgrade nodejs-is-binary-pathUpgrade openshift-origin-node-proxyUpgrade nodejs-error-exUpgrade openshift-origin-broker-utilUpgrade heapsterUpgrade nodejs-expand-bracketsUpgrade nodejs-fill-rangeUpgrade nodejs-lazy-cacheUpgrade nss_wrapperUpgrade nodejs-is-globUpgrade nodejs-isobjectUpgrade rhcUpgrade nodejs-glob-parentUpgrade openshift-origin-node-utilUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-slideUpgrade openshift-ansibleUpgrade nodejs-registry-urlUpgrade nodejs-lodash.keysUpgrade nodejs-chokidarUpgrade nodejs-for-inUpgrade nodejs-node-status-codes | Jun 18, 2018 | Nov 11, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub