Description
A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.
Remediation
References
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-637
Related Vulnerabilities
CVE-2011-2894 Vulnerability in maven package org.springframework.security:spring-security-core
CVE-2023-49798 Vulnerability in npm package @openzeppelin/contracts-upgradeable
CVE-2018-1322 Vulnerability in maven package org.apache.syncope:syncope-core
CVE-2023-48219 Vulnerability in maven package org.webjars.npm:tinymce
CVE-2017-7661 Vulnerability in maven package org.apache.cxf.fediz:fediz-jetty8