The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins LTS to version 1.625.2Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest versionUpgrade Jenkins to version 1.638 | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade nodejs-is-extglobUpgrade nodejs-kind-ofUpgrade nodejs-es6-promiseUpgrade nodejs-create-error-classUpgrade nodejs-glob-baseUpgrade origin-kibanaUpgrade nodejs-async-eachUpgrade nodejs-arr-flattenUpgrade nodejs-gotUpgrade nodejs-osenvUpgrade nodejs-regex-cacheUpgrade nodejs-semverUpgrade nodejs-readdirpUpgrade nodejs-lodash.defaultsUpgrade nodejs-mkdirpUpgrade nodejs-configstoreUpgrade nodejs-anymatchUpgrade nodejs-preserveUpgrade nodejs-rcUpgrade nodejs-lodash.isargumentsUpgrade nodejs-parse-globUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-splitUpgrade nodejs-strip-json-commentsUpgrade openshift-enterprise-upgradeUpgrade nodejs-graceful-fsUpgrade nodejs-filename-regexUpgrade openshift-origin-cartridge-haproxyUpgrade activemqUpgrade nodejs-extglobUpgrade nodejs-touchUpgrade nodejs-ansi-greenUpgrade openshift-origin-cartridge-cronUpgrade nodejs-iniUpgrade nodejs-pause-streamUpgrade nodejs-arr-diffUpgrade nodejs-duplexerUpgrade nodejs-is-equal-shallowUpgrade nodejs-url-parse-laxUpgrade nodejs-latest-versionUpgrade openvswitchUpgrade nodejs-is-redirectUpgrade nodejs-arrifyUpgrade nodejs-repeat-elementUpgrade nodejs-expand-rangeUpgrade nodejs-throughUpgrade nodejs-duplexifyUpgrade nodejs-lodash.getnativeUpgrade nodejs-is-streamUpgrade nodejs-nodemonUpgrade nodejs-write-file-atomicUpgrade nodejs-lodash.assignUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-pinkieUpgrade nodejs-is-primitiveUpgrade nodejs-uuidUpgrade openshift-origin-cartridge-mysqlUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-event-streamUpgrade nodejs-object.omitUpgrade nodejs-read-all-streamUpgrade nodejs-optimistUpgrade phpUpgrade nodejs-is-plain-objUpgrade nodejs-undefsafeUpgrade nodejs-deep-extendUpgrade nodejs-stream-combinerUpgrade nodejs-map-streamUpgrade nodejs-chokidarUpgrade openshift-origin-node-utilUpgrade nodejs-expand-bracketsUpgrade nodejs-pinkie-promiseUpgrade nodejs-bracesUpgrade nodejs-success-symbolUpgrade nodejs-is-numberUpgrade nodejs-prepend-httpUpgrade nodejs-object-assignUpgrade openshift-origin-node-proxyUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-lodash.basecopyUpgrade atomic-openshiftUpgrade nodejs-capture-stack-traceUpgrade openshift-origin-broker-utilUpgrade nodejs-for-ownUpgrade rhcUpgrade openshift-origin-msg-node-mcollectiveUpgrade heapsterUpgrade jenkinsUpgrade nodejs-isobjectUpgrade nodejs-slideUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-is-dotfileUpgrade openshift-origin-cartridge-phpUpgrade nodejs-node-status-codesUpgrade nodejs-glob-parentUpgrade openshift-ansibleUpgrade nodejs-is-binary-pathUpgrade rubygem-openshift-origin-commonUpgrade nodejs-ps-treeUpgrade nodejs-ansi-wrapUpgrade nodejs-fill-rangeUpgrade nodejs-fromUpgrade nodejs-package-jsonUpgrade nodejs-xdg-basedirUpgrade nodejs-os-homedirUpgrade nodejs-string-lengthUpgrade nodejs-os-tmpdirUpgrade nodejs-binary-extensionsUpgrade nss_wrapperUpgrade nodejs-normalize-pathUpgrade nodejs-error-exUpgrade nodejs-lodash.createassignerUpgrade nodejs-lowercase-keysUpgrade nodejs-parse-jsonUpgrade nodejs-lodash.baseassignUpgrade nodejs-lodash.isarrayUpgrade nodejs-is-extendableUpgrade nodejs-end-of-streamUpgrade nodejs-is-npmUpgrade nodejs-lazy-cacheUpgrade nodejs-unzip-responseUpgrade nodejs-array-uniqueUpgrade nodejs-is-globUpgrade nodejs-randomaticUpgrade nodejs-timed-outUpgrade nodejs-update-notifierUpgrade nodejs-micromatchUpgrade nodejs-lodash.keysUpgrade nodejs-for-inUpgrade nodejs-align-textUpgrade nodejs-registry-urlUpgrade nodejs-lodash.restparamUpgrade nodejs-semver-diff | Jun 18, 2018 | Nov 11, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub