Description
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
Remediation
References
https://jenkins.io/security/advisory/2017-04-26/
https://www.exploit-db.com/exploits/41965/
http://www.securityfocus.com/bid/98056
http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.html
https://www.oracle.com/security-alerts/cpuapr2022.html
Related Vulnerabilities
CVE-2022-36084 Vulnerability in npm package cruddl
CVE-2023-22465 Vulnerability in maven package org.http4s:http4s-core_2.12
CVE-2019-10241 Vulnerability in maven package org.eclipse.jetty.aggregate:jetty-all
CVE-2021-3632 Vulnerability in maven package org.keycloak:keycloak-core
CVE-2015-5345 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core