REDHAT-BUG-2487539: High severity Jenkins Jenkins vulnerability
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkinsto a version that resolves this vulnerability.Fixed in 2.567 - Upgrade
Upgrade
Jenkins LTSto a version that resolves this vulnerability.Fixed in 2.555.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487539?
The severity of REDHAT-BUG-2487539 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2487539?
To fix REDHAT-BUG-2487539, upgrade Jenkins to version 2.568 or later.
What versions of Jenkins are affected by REDHAT-BUG-2487539?
Jenkins versions 2.567 and earlier, as well as LTS 2.555.2 and earlier, are affected by REDHAT-BUG-2487539.
What type of vulnerability is REDHAT-BUG-2487539?
REDHAT-BUG-2487539 is a deserialization vulnerability that can allow attackers to handle HTTP requests.
How can attackers exploit REDHAT-BUG-2487539?
Attackers can exploit REDHAT-BUG-2487539 by submitting a malicious `config.xml` that enables deserialization of arbitrary types.