CVE-2023-27900: High severity jenkins lts vulnerability
A flaw was found in Jenkins. Affected versions of Jenkins use the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.
Other sources
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 is affected by the Apache Commons FileUpload library’s vulnerability CVE-2023-24998. This library is used to process uploaded files via the Stapler web framework (usually through StaplerRequest#getFile) and MultipartFormDataParser in Jenkins.
This allows attackers to cause a denial of service (DoS) by sending crafted requests to HTTP endpoints processing file uploads.
Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 limits the number of request parts to be processed to 1000. Specific endpoints receiving only simple form submissions have a lower limit.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-27900?
CVE-2023-27900 is a vulnerability in Jenkins that allows attackers to trigger a denial of service by exploiting the Apache Commons FileUpload library.
What versions of Jenkins are affected by CVE-2023-27900?
Versions 2.393 and earlier, as well as LTS 2.375.3 and earlier, are affected by CVE-2023-27900.
How can I fix CVE-2023-27900 in Jenkins?
To fix CVE-2023-27900, you should update Jenkins to version 2.394 or later.
Is there a fix available for the LTS version of Jenkins?
Yes, there is a fix available for the LTS version of Jenkins. You should update to LTS 2.375.4 or later.
Where can I find more information about CVE-2023-27900?
You can find more information about CVE-2023-27900 on the CVE website, NVD, Jenkins security advisory, and Red Hat Bugzilla.