Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been
    updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource
    usage. (CVE-2022-0538)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.277.x prior to 2.277.43.0.6, 2.303.x prior to 2.303.30.0.5, or 2.x prior to 2.319.3.3. It is, therefore, affected by multiple vulnerabilities:

  - XStream is an open source java library to serialize objects to XML and back again. Versions prior to     1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or     parallel execution of such a payload resulting in a denial of service only by manipulating the processed     input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and     throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible.
    Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for     further details on a workaround if an upgrade is not possible. (CVE-2021-43859)

  - Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been     updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage. (CVE-2022-0538)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0b0ad196-1ee8-4a98-89b1-4d5d82af49a9 advisory.

  - XStream is an open source java library to serialize objects to XML and back again. Versions prior to     1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or     parallel execution of such a payload resulting in a denial of service only by manipulating the processed     input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and     throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible.
    Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for     further details on a workaround if an upgrade is not possible. (CVE-2021-43859)

  - Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been     updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource     usage. (CVE-2022-0538)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.319.3 or Jenkins weekly prior to 2.334. It is, therefore, affected by multiple vulnerabilities:

  - XStream is an open source java library to serialize objects to XML and back again. Versions prior to     1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or     parallel execution of such a payload resulting in a denial of service only by manipulating the processed     input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and     throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible.
    Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for     further details on a workaround if an upgrade is not possible. (CVE-2021-43859)

  - Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been     updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource     usage. (CVE-2022-0538)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
409290	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-34wx-x2w9-vqm3)	Tenable Cloud Security	SCA Checks	Local	high
409290	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-34wx-x2w9-vqm3)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
405044	Alpine: multiple jenkins packages: security update to 2.319.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
405044	Alpine: multiple jenkins packages: security update to 2.319.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
158672	Jenkins Enterprise and Operations Center 2.277.x < 2.277.43.0.6 / 2.303.x < 2.303.30.0.5 / 2.319.3.3 Multiple DoS (CloudBees Security Advisory 2022-02-09)	Nessus	CGI abuses	Combined	high
157887	FreeBSD : jenkins -- DoS vulnerability in bundled XStream library (0b0ad196-1ee8-4a98-89b1-4d5d82af49a9)	Nessus	FreeBSD Local Security Checks	Local	high
407655	Alpine: multiple jenkins packages: security update to 2.319.2-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
407655	Alpine: multiple jenkins packages: security update to 2.319.2-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
157860	Jenkins LTS < 2.319.3 / Jenkins weekly < 2.334 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	high

Detections

Analytics

CVE-2022-0538

high

Tenable Plugins

high

high

high

high

high

high

high

high

high