PT-2022-13249 · Jenkins · Jenkins

Published 2022-02-09 · Updated 2024-03-06 · CVE-2022-0538

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.333 and earlier Jenkins LTS versions 2.319.2 and earlier

Description The issue is related to custom XStream converters that have not been updated to apply protections, allowing unconstrained resource usage.

Recommendations For Jenkins versions 2.333 and earlier, update to a version that applies the necessary protections. For Jenkins LTS versions 2.319.2 and earlier, update to a version that applies the necessary protections. As a temporary workaround, consider restricting the use of custom XStream converters until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BIT-JENKINS-2022-0538

CVE-2022-0538

GHSA-34WX-X2W9-VQM3

Affected Products

Jenkins

References · 9

• https://jenkins.io/security/advisory/2022-02-09/#SECURITY-2602 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-34wx-x2w9-vqm3 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2022-0538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0538 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0538 · Vendor Advisory
• https://github.com/jenkinsci/jenkins/commit/8276aef4cc3dd81810fe6bdf6fa48141632c4636 · Note
• https://t.me/cvenotify/26507 · Telegram Post
• https://t.me/cibsecurity/37055 · Telegram Post
• http://openwall.com/lists/oss-security/2022/02/09/1 · Note