Description

The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2016-1773.html

https://access.redhat.com/errata/RHSA-2016:0711

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24

Related Vulnerabilities

CVE-2023-25157 Vulnerability in maven package org.geoserver.community:gs-jdbcconfig

CVE-2019-20921 Vulnerability in npm package bootstrap-select

CVE-2020-7748 Vulnerability in npm package @tsed/core

CVE-2023-29014 Vulnerability in maven package io.goobi.viewer:viewer-core

CVE-2010-2276 Vulnerability in npm package dojo

Severity

Critical

Classification

CWE-264 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Vendor Advisory