CVE-2017-1000353: Jenkins Remote Code Execution Vulnerability
Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism.
Other sources
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java SignedObject object to the Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding SignedObject to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkinsto a version that resolves this vulnerability.Fixed in 2.46.2 - Configuration
Disable the remoting-based (Java serialization) CLI protocol to prevent unauthenticated SignedObject instances from being deserialized.
Jenkins CLI (remoting-based, Java serialization) CLI protocol (remoting-based) = disabled - Configuration
Add 'SignedObject' to the deserialization blacklist to block deserialization of java.security.SignedObject instances.
Jenkins deserialization blacklist blacklist entry = SignedObject - Compensating control
Follow applicable BOD 22-01 guidance for cloud services.
- Compensating control
Discontinue use of the product if mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000353?
CVE-2017-1000353 has been classified as a critical vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2017-1000353?
To fix CVE-2017-1000353, update Jenkins to version 2.60 or later, or 2.46.2 LTS or later.
Which versions of Jenkins are affected by CVE-2017-1000353?
CVE-2017-1000353 affects Jenkins versions 2.56 and earlier, as well as 2.46.1 LTS and earlier.
Can CVE-2017-1000353 be exploited remotely?
Yes, CVE-2017-1000353 can be exploited remotely by attackers without authentication.
Is there a workaround for CVE-2017-1000353?
There are no effective workarounds for CVE-2017-1000353; upgrading is the recommended course of action.