Veracode Vulnerability DatabaseVERACODE:16660Command Injection
EPSS
Percentile
98.5%
Jenkins is vulnerable to command injection. The attack exists because it allows an injection of serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the “Groovy variant in ‘ysoserial’”.
References
foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#jenkins
packetstormsecurity.com/files/134805/Jenkins-CLI-RMI-Java-Deserialization.html
rhn.redhat.com/errata/RHSA-2016-0489.html
www.openwall.com/lists/oss-security/2015/11/09/5
www.openwall.com/lists/oss-security/2015/11/18/11
www.openwall.com/lists/oss-security/2015/11/18/13
www.openwall.com/lists/oss-security/2015/11/18/2
www.securityfocus.com/bid/77636
access.redhat.com/errata/RHSA-2016:0070
access.redhat.com/security/updates/classification/#important
bugzilla.redhat.com/show_bug.cgi?id=1243514
bugzilla.redhat.com/show_bug.cgi?id=1247523
bugzilla.redhat.com/show_bug.cgi?id=1254880
bugzilla.redhat.com/show_bug.cgi?id=1256869
bugzilla.redhat.com/show_bug.cgi?id=1268478
bugzilla.redhat.com/show_bug.cgi?id=1273739
bugzilla.redhat.com/show_bug.cgi?id=1277329
bugzilla.redhat.com/show_bug.cgi?id=1277383
bugzilla.redhat.com/show_bug.cgi?id=1277608
bugzilla.redhat.com/show_bug.cgi?id=1278232
bugzilla.redhat.com/show_bug.cgi?id=1278630
bugzilla.redhat.com/show_bug.cgi?id=1279404
bugzilla.redhat.com/show_bug.cgi?id=1279744
bugzilla.redhat.com/show_bug.cgi?id=1279925
bugzilla.redhat.com/show_bug.cgi?id=1280216
bugzilla.redhat.com/show_bug.cgi?id=1280497
bugzilla.redhat.com/show_bug.cgi?id=1282426
bugzilla.redhat.com/show_bug.cgi?id=1282738
bugzilla.redhat.com/show_bug.cgi?id=1283952
bugzilla.redhat.com/show_bug.cgi?id=1284506
bugzilla.redhat.com/show_bug.cgi?id=1287414
bugzilla.redhat.com/show_bug.cgi?id=1287943
bugzilla.redhat.com/show_bug.cgi?id=1288014
bugzilla.redhat.com/show_bug.cgi?id=1289603
bugzilla.redhat.com/show_bug.cgi?id=1289965
bugzilla.redhat.com/show_bug.cgi?id=1290643
bugzilla.redhat.com/show_bug.cgi?id=1290967
bugzilla.redhat.com/show_bug.cgi?id=1292621
bugzilla.redhat.com/show_bug.cgi?id=1293251
bugzilla.redhat.com/show_bug.cgi?id=1293252
bugzilla.redhat.com/show_bug.cgi?id=1293829
bugzilla.redhat.com/show_bug.cgi?id=1293877
bugzilla.redhat.com/show_bug.cgi?id=1294115
bugzilla.redhat.com/show_bug.cgi?id=1294798
bugzilla.redhat.com/show_bug.cgi?id=1296457
jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli
rhn.redhat.com/errata/RHSA-2016-0070.html
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
www.exploit-db.com/exploits/38983/
Related
