What is GHSA-4466-8jm4-448p?

GHSA-4466-8jm4-448p is a security advisory published by GitHub Security Advisories with Medium severity. Deserialization of Untrusted Data in Jenkins

Which CVE IDs does GHSA-4466-8jm4-448p cover?

GHSA-4466-8jm4-448p covers the following CVE IDs: CVE-2017-1000355. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4466-8jm4-448p?

GHSA-4466-8jm4-448p has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-4466-8jm4-448p?

GHSA-4466-8jm4-448p affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003e= 2.50, \u003c= 2.56; maven/org.jenkins-ci.main:jenkins-core:\u003c= 2.46.1.

GHSA-4466-8jm4-448pMediumCVSS 6.5

Deserialization of Untrusted Data in Jenkins

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

March 4, 2024

🔗 CVE IDs covered (1)

CVE-2017-1000355 →

📋 Description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:>= 2.50, <= 2.56
maven/org.jenkins-ci.main:jenkins-core:<= 2.46.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2017-1000355
http://www.securityfocus.com/bid/98066
https://github.com/jenkinsci/jenkins/commit/701ea95a52afe53bee28f76a3f96eb0e578852e9
https://github.com/jenkinsci/jenkins/commit/f7075e60772bd2fa15bcc72450735641c168fed5
https://jenkins.io/security/advisory/2017-04-26
https://github.com/advisories/GHSA-4466-8jm4-448p