~ / search / GHSA-28p3-mchr-9frj

GHSA-28p3-mchr-9frj

Deserialization of Untrusted Data in Jenkins

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1999042

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.main:jenkins-core < 2.121.3 2.121.3
Maven org.jenkins-ci.main:jenkins-core >= 2.122, < 2.138 2.138

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.

References

External links from the advisory. They lead to third-party sites.