https://bugzilla.redhat.com/show_bug.cgi?id=1395172
Bug ID: 1395172
Summary: CVE-2016-9299 jenkins: Java deserialization flaw leads
to RCE
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
An unauthenticated remote code execution vulnerability was discovered in the
Jenkins continuous integration and continuous delivery automation server. A
serialized Java object transferred to the Jenkins CLI can make Jenkins connect
to an attacker-controlled LDAP server, which in turn can send a serialized
payload leading to code execution, bypassing existing protection mechanisms.
Upstream advisory:
https://groups.google.com/forum/#!msg/jenkinsci-advisories/-fc-w9tNEJE/GR...
Mitigation:
https://github.com/jenkinsci-cert/SECURITY-218
CVE assignment:
http://seclists.org/oss-sec/2016/q4/423
--
You are receiving this mail because:
You are on the CC list for the bug.