GHSA-fwqr-3pvp-pjwqHighCVSS 8.8

Deserialization of Untrusted Data in Jenkins

Published
May 13, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2017-2608 →

📋 Description

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs (SECURITY-383).

🎯 Affected products2

  • maven/org.jenkins-ci.main:jenkins-core:< 2.32.2
  • maven/org.jenkins-ci.main:jenkins-core:>= 2.34, < 2.44

🔗 References (6)