Deserialization of Untrusted Data in Jenkins
Critical severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Package
Affected versions
>= 2.50, <= 2.56
<= 2.46.1
Patched versions
2.57
2.46.2
Description
Published by the National Vulnerability Database
Jan 29, 2018
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Jul 1, 2022
Last updated
Jan 27, 2023
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java
SignedObjectobject to the Jenkins CLI, that would be deserialized using a newObjectInputStream, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by addingSignedObjectto the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.References