CVE-2016-9299

Опубликовано: 12 янв. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Высокий

Описание

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

Ссылки

http://www.openwall.com/lists/oss-security/2016/11/12/4
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/11/14/9
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/94281
Third Party Advisory
VDB Entry
http://www.slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition
Third Party Advisory
https://groups.google.com/forum/#%21original/jenkinsci-advisories/-fc-w9tNEJE/GRvEzWoJBgAJ
https://groups.google.com/forum/#%21original/jenkinsci-advisories/-fc-w9tNEJE/LZ7EOS0fBgAJ
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW2KUKYLNLVDB7STLHLYALCUFLEGCRM6/
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16
Vendor Advisory
https://www.cloudbees.com/jenkins-security-advisory-2016-11-16
Vendor Advisory
https://www.exploit-db.com/exploits/44642/
Third Party Advisory
VDB Entry
http://www.openwall.com/lists/oss-security/2016/11/12/4
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/11/14/9
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/94281
Third Party Advisory
VDB Entry
http://www.slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition
Third Party Advisory
https://groups.google.com/forum/#%21original/jenkinsci-advisories/-fc-w9tNEJE/GRvEzWoJBgAJ
https://groups.google.com/forum/#%21original/jenkinsci-advisories/-fc-w9tNEJE/LZ7EOS0fBgAJ
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW2KUKYLNLVDB7STLHLYALCUFLEGCRM6/
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16
Vendor Advisory
https://www.cloudbees.com/jenkins-security-advisory-2016-11-16
Vendor Advisory
https://www.exploit-db.com/exploits/44642/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*

Версия до 2.19.2 (включая)

cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*

Версия до 2.31 (включая)

Конфигурация 2

cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.86028

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-90

Связанные уязвимости

CVE-2016-9299

CVSS3: 9.8

ubuntu

около 9 лет назад

CVE-2016-9299

CVSS3: 8.1

redhat

около 9 лет назад

CVE-2016-9299

CVSS3: 9.8

debian

около 9 лет назад

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allow ...

GHSA-2x9h-h3c4-wqqh

CVSS3: 9.8

github

больше 3 лет назад

Improper Neutralization of Special Elements used in an LDAP Query in Jenkins

EPSS

Процентиль: 99%

0.86028

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-90