CVE-2017-1000355: Medium severity jenkins lts vulnerability
Published Jan 29, 2018
·Updated
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.
Affected Software
4 affected componentsFixes available
maven/org.jenkins-ci.main:jenkins-core<=2.46.1
2.46.2
maven/org.jenkins-ci.main:jenkins-core>=2.50<=2.56
2.57
Jenkins Jenkins<=2.56
Jenkins Jenkins<=2.46.1
Event History
Jan 29, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
May 14, 2022
Advisory Published
via GitHub·03:44 AM
Frequently Asked Questions
1
What should I do if I cannot update Jenkins for CVE-2017-1000355?
If you cannot update Jenkins, consider implementing network segmentation strategies and other security measures to reduce exposure.