Description

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.

Remediation

References

https://access.redhat.com/errata/RHSA-2016:0070

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01

Related Vulnerabilities

CVE-2010-4172 Vulnerability in maven package org.apache.tomcat:catalina

CVE-2018-1999025 Vulnerability in maven package de.tracetronic.jenkins.plugins:ecutest

CVE-2023-29520 Vulnerability in maven package org.xwiki.platform:xwiki-platform-localization-source-wiki

CVE-2012-0803 Vulnerability in maven package org.apache.cxf:cxf-bundle-minimal

CVE-2010-2076 Vulnerability in maven package org.apache.cxf:cxf-bundle-jaxrs

Severity

Critical

Classification

CWE-94

Tags

Vendor Advisory