CVE-2016-9299: Critical severity Jenkins Jenkins vulnerability
Published Jan 12, 2017
·Updated
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.
Affected Software
5 affected componentsFixes available
maven/org.jenkins-ci.main:jenkins-core<=2.19.2
2.19.3
maven/org.jenkins-ci.main:jenkins-core>=2.20<=2.31
2.32
Jenkins Jenkins<=2.19.2
Jenkins Jenkins<=2.31
Fedoraproject Fedora=25
Event History
Jan 12, 2017
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Data Sourced
via NVD·11:59 PM
DescriptionSeverityWeaknessAffected Software
May 14, 2022
Advisory Published
via GitHub·01:00 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-9299?
CVE-2016-9299 is considered a critical vulnerability due to its potential to allow remote code execution.
2
How do I fix CVE-2016-9299?
To mitigate CVE-2016-9299, upgrade Jenkins to version 2.32 or later, or to LTS version 2.19.3 or later.
3
What versions of Jenkins are affected by CVE-2016-9299?
CVE-2016-9299 affects Jenkins versions prior to 2.32 and LTS versions prior to 2.19.3.
4
Can CVE-2016-9299 be exploited remotely?
Yes, CVE-2016-9299 can be exploited remotely by attackers using crafted serialized Java objects.
5
What impact does CVE-2016-9299 have on my Jenkins installation?
Exploitation of CVE-2016-9299 can lead to arbitrary code execution on the server where Jenkins is running.