The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute
    arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.
    (CVE-2016-9299)

Security fix for CVE-2016-9299

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jenkins Security Advisory :

An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java object to the Jenkins CLI, making Jenkins connect to an attacker-controlled LDAP server, which in turn can send a serialized payload leading to code execution, bypassing existing protection mechanisms.

ID	Name	Product	Family	Severity
409166	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-2x9h-h3c4-wqqh)	Tenable Cloud Security	SCA Checks	critical
409166	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-2x9h-h3c4-wqqh)	Tenable Self-Hosted Container Security	SCA Checks	critical
97533	Fedora 24 : jenkins / jenkins-remoting (2016-93679a91df)	Nessus	Fedora Local Security Checks	critical
95446	Fedora 25 : jenkins / jenkins-remoting (2016-368780879d)	Nessus	Fedora Local Security Checks	critical
94918	FreeBSD : jenkins -- Remote code execution vulnerability in remoting module (27eee66d-9474-44a5-b830-21ec12a1c307)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-9299

critical

Tenable Plugins

critical

critical

critical

critical

critical