CVE-2018-1000861: Deserialization of Untrusted Data in Jenkins
(updated )
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
References
- access.redhat.com/errata/RHBA-2019:0024
- github.com/advisories/GHSA-hhpm-5cp2-hg4x
- github.com/jenkinsci/jenkins/commit/47f38d714c99e1841fb737ad1005618eb26ed852
- jenkins.io/security/advisory/2018-12-05/
- nvd.nist.gov/vuln/detail/CVE-2018-1000861
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1000861
Code Behaviors & Features
Detect and mitigate CVE-2018-1000861 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →