Description

Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2015-1844.html

https://access.redhat.com/errata/RHSA-2016:0070

https://bugzilla.redhat.com/show_bug.cgi?id=1205623

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27

Related Vulnerabilities

CVE-2023-26478 Vulnerability in maven package org.xwiki.platform:xwiki-platform-store-filesystem-oldcore

CVE-2015-1836 Vulnerability in maven package org.apache.hbase:hbase-client

CVE-2017-5662 Vulnerability in maven package org.eclipse.birt.runtime:org.apache.batik.dom

CVE-2023-34040 Vulnerability in maven package org.springframework.kafka:spring-kafka

CVE-2022-41251 Vulnerability in maven package org.jenkins-ci.plugins:apprenda

Severity

Critical

Classification

CWE-20

Tags

Vendor Advisory