The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 1.625.2Upgrade Jenkins to the latest versionUpgrade Jenkins to version 1.638 | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade nodejs-error-exUpgrade nodejs-xdg-basedirUpgrade nodejs-is-binary-pathUpgrade nodejs-fromUpgrade nodejs-binary-extensionsUpgrade nodejs-os-tmpdirUpgrade nodejs-glob-parentUpgrade nodejs-is-npmUpgrade nodejs-parse-jsonUpgrade nodejs-node-status-codesUpgrade nodejs-fill-rangeUpgrade nodejs-for-ownUpgrade nodejs-update-notifierUpgrade nodejs-registry-urlUpgrade nodejs-pinkie-promiseUpgrade nodejs-os-homedirUpgrade nodejs-align-textUpgrade nss_wrapperUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-chokidarUpgrade nodejs-normalize-pathUpgrade nodejs-is-extendableUpgrade nodejs-is-dotfileUpgrade nodejs-ansi-wrapUpgrade nodejs-slideUpgrade nodejs-unzip-responseUpgrade nodejs-isobjectUpgrade nodejs-prepend-httpUpgrade nodejs-expand-bracketsUpgrade nodejs-randomaticUpgrade openshift-origin-broker-utilUpgrade nodejs-ps-treeUpgrade rubygem-openshift-origin-commonUpgrade nodejs-lodash.keysUpgrade nodejs-string-lengthUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-array-uniqueUpgrade nodejs-lodash.basecopyUpgrade openshift-origin-cartridge-phpUpgrade atomic-openshiftUpgrade nodejs-semver-diffUpgrade nodejs-success-symbolUpgrade openshift-origin-msg-node-mcollectiveUpgrade openshift-ansibleUpgrade nodejs-lodash.createassignerUpgrade nodejs-bracesUpgrade nodejs-capture-stack-traceUpgrade nodejs-is-numberUpgrade jenkinsUpgrade nodejs-timed-outUpgrade nodejs-lodash.baseassignUpgrade nodejs-is-globUpgrade openshift-origin-node-proxyUpgrade nodejs-lowercase-keysUpgrade rhcUpgrade openshift-origin-node-utilUpgrade nodejs-package-jsonUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-object-assignUpgrade heapsterUpgrade nodejs-lodash.restparamUpgrade nodejs-micromatchUpgrade nodejs-lazy-cacheUpgrade nodejs-end-of-streamUpgrade nodejs-lodash.isarrayUpgrade nodejs-for-inUpgrade nodejs-parse-globUpgrade nodejs-iniUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-strip-json-commentsUpgrade nodejs-is-equal-shallowUpgrade nodejs-is-redirectUpgrade nodejs-touchUpgrade nodejs-preserveUpgrade nodejs-semverUpgrade nodejs-throughUpgrade nodejs-map-streamUpgrade nodejs-is-primitiveUpgrade nodejs-is-streamUpgrade origin-kibanaUpgrade nodejs-pinkieUpgrade nodejs-is-extglobUpgrade nodejs-filename-regexUpgrade nodejs-undefsafeUpgrade nodejs-arrifyUpgrade openshift-origin-cartridge-cronUpgrade openvswitchUpgrade nodejs-optimistUpgrade nodejs-expand-rangeUpgrade nodejs-extglobUpgrade nodejs-arr-flattenUpgrade nodejs-lodash.assignUpgrade nodejs-repeat-elementUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-latest-versionUpgrade nodejs-osenvUpgrade nodejs-glob-baseUpgrade nodejs-anymatchUpgrade nodejs-duplexerUpgrade nodejs-uuidUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-es6-promiseUpgrade phpUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-ansi-greenUpgrade activemqUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-graceful-fsUpgrade nodejs-rcUpgrade nodejs-readdirpUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-is-plain-objUpgrade nodejs-create-error-classUpgrade nodejs-stream-combinerUpgrade nodejs-write-file-atomicUpgrade nodejs-read-all-streamUpgrade nodejs-mkdirpUpgrade nodejs-async-eachUpgrade nodejs-arr-diffUpgrade nodejs-pause-streamUpgrade nodejs-lodash.isargumentsUpgrade nodejs-object.omitUpgrade nodejs-configstoreUpgrade nodejs-lodash.defaultsUpgrade openshift-enterprise-upgradeUpgrade nodejs-splitUpgrade nodejs-event-streamUpgrade nodejs-lodash.getnativeUpgrade nodejs-deep-extendUpgrade nodejs-nodemonUpgrade nodejs-kind-ofUpgrade nodejs-url-parse-laxUpgrade nodejs-gotUpgrade nodejs-regex-cacheUpgrade nodejs-duplexify | Jun 18, 2018 | Nov 11, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub