CVE-2022-0538: Deserialization of Untrusted Data

February 9, 2022 (updated November 30, 2023)

Jenkins defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.

References

www.openwall.com/lists/oss-security/2022/02/09/1
nvd.nist.gov/vuln/detail/CVE-2022-0538
www.jenkins.io/security/advisory/2022-02-09/

Code Behaviors & Features

Detect and mitigate CVE-2022-0538 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →