https://bugzilla.redhat.com/show_bug.cgi?id=1282371
Bug ID: 1282371
Summary: jenkins: Remote code execution vulnerability due to
unsafe deserialization in Jenkins remoting
(SECURITY-218)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
Unsafe deserialization allows unauthenticated remote attackers to run arbitrary
code on the Jenkins master.
This flaw could allow unauthenticated remote attackers to run arbitrary code on
Jenkins.
Mitigation:
https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-exe...
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=cAmrN8IiEj&a=cc_unsubscribe