The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins LTS to version 1.625.2Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 1.638Upgrade Jenkins to the latest version | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade nodejs-for-ownUpgrade nodejs-is-globUpgrade nodejs-is-numberUpgrade nodejs-lodash.baseassignUpgrade nodejs-lodash.isarrayUpgrade nodejs-registry-urlUpgrade nodejs-is-binary-pathUpgrade nodejs-lodash.keysUpgrade nodejs-fromUpgrade jenkinsUpgrade nodejs-semver-diffUpgrade nodejs-lodash.createassignerUpgrade openshift-ansibleUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-randomaticUpgrade nodejs-is-extendableUpgrade nodejs-expand-bracketsUpgrade rhcUpgrade nodejs-prepend-httpUpgrade nodejs-parse-jsonUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-xdg-basedirUpgrade nodejs-binary-extensionsUpgrade nodejs-lazy-cacheUpgrade nodejs-error-exUpgrade nodejs-slideUpgrade nodejs-lodash.basecopyUpgrade nodejs-update-notifierUpgrade nodejs-for-inUpgrade openshift-origin-cartridge-phpUpgrade nodejs-timed-outUpgrade nodejs-array-uniqueUpgrade nodejs-chokidarUpgrade openshift-origin-node-utilUpgrade nodejs-is-dotfileUpgrade atomic-openshiftUpgrade openshift-origin-broker-utilUpgrade nodejs-isobjectUpgrade nodejs-pinkie-promiseUpgrade nodejs-os-homedirUpgrade nodejs-bracesUpgrade nodejs-unzip-responseUpgrade nodejs-fill-rangeUpgrade nodejs-ps-treeUpgrade nss_wrapperUpgrade nodejs-is-npmUpgrade nodejs-os-tmpdirUpgrade nodejs-capture-stack-traceUpgrade nodejs-micromatchUpgrade nodejs-package-jsonUpgrade nodejs-string-lengthUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-ansi-wrapUpgrade nodejs-object-assignUpgrade nodejs-end-of-streamUpgrade nodejs-align-textUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-lowercase-keysUpgrade heapsterUpgrade nodejs-node-status-codesUpgrade rubygem-openshift-origin-commonUpgrade openshift-origin-node-proxyUpgrade nodejs-success-symbolUpgrade nodejs-normalize-pathUpgrade nodejs-glob-parentUpgrade nodejs-lodash.restparamUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-uuidUpgrade nodejs-strip-json-commentsUpgrade nodejs-latest-versionUpgrade nodejs-throughUpgrade nodejs-preserveUpgrade nodejs-rcUpgrade nodejs-lodash.assignUpgrade nodejs-semverUpgrade nodejs-write-file-atomicUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-deep-extendUpgrade nodejs-gotUpgrade nodejs-nodemonUpgrade nodejs-filename-regexUpgrade nodejs-repeat-elementUpgrade nodejs-is-extglobUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-pinkieUpgrade nodejs-mkdirpUpgrade nodejs-arr-diffUpgrade openshift-origin-cartridge-mysqlUpgrade origin-kibanaUpgrade nodejs-arr-flattenUpgrade nodejs-splitUpgrade nodejs-kind-ofUpgrade nodejs-map-streamUpgrade openvswitchUpgrade nodejs-stream-combinerUpgrade nodejs-regex-cacheUpgrade nodejs-is-streamUpgrade nodejs-undefsafeUpgrade nodejs-anymatchUpgrade nodejs-is-plain-objUpgrade nodejs-extglobUpgrade phpUpgrade nodejs-optimistUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-object.omitUpgrade nodejs-ansi-greenUpgrade openshift-origin-cartridge-cronUpgrade openshift-enterprise-upgradeUpgrade nodejs-lodash.isargumentsUpgrade nodejs-read-all-streamUpgrade nodejs-es6-promiseUpgrade nodejs-readdirpUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-glob-baseUpgrade nodejs-url-parse-laxUpgrade nodejs-event-streamUpgrade nodejs-arrifyUpgrade nodejs-is-equal-shallowUpgrade nodejs-configstoreUpgrade nodejs-lodash.defaultsUpgrade nodejs-touchUpgrade nodejs-lodash.getnativeUpgrade nodejs-osenvUpgrade nodejs-duplexifyUpgrade nodejs-pause-streamUpgrade activemqUpgrade nodejs-expand-rangeUpgrade nodejs-is-primitiveUpgrade nodejs-is-redirectUpgrade nodejs-iniUpgrade nodejs-parse-globUpgrade nodejs-graceful-fsUpgrade nodejs-create-error-classUpgrade nodejs-duplexerUpgrade nodejs-async-each | Jun 18, 2018 | Nov 11, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub