Test ID:	1.3.6.1.4.1.25623.1.0.147621
Category:	Denial of Service
Title:	Jenkins < 2.319.3, < 2.334 DoS Vulnerability - Linux
Summary:	Jenkins is prone to a denial of service (DoS) vulnerability.
Description:	Summary: Jenkins is prone to a denial of service (DoS) vulnerability. Vulnerability Insight: Jenkins is affected by the XStream library's vulnerability CVE-2021-43859. This library is used by Jenkins to serialize and deserialize various XML files, like global and job config.xml, build.xml, and numerous others. This allows attackers able to submit crafted XML files to Jenkins to be parsed as configuration, e.g. through the POST config.xml API, to cause a denial of service (DoS). Affected Software/OS: Jenkins version 2.333 and prior and 2.319.2 LTS and prior. Solution: Update to version 2.334, 2.319.3 LTS or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-43859 https://github.com/x-stream/xstream/security/advisories/GHSA-rmr5-cpv2-vgjf https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VACQYG356OHUTD5WQGAQ4L2TTFTAV3SJ/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XODFRE2ZL64FICBJDOPWOLPTSSAI4U7X/ https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846 https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujul2022.html https://x-stream.github.io/CVE-2021-43859.html https://lists.debian.org/debian-lts-announce/2022/02/msg00018.html http://www.openwall.com/lists/oss-security/2022/02/09/1 Common Vulnerability Exposure (CVE) ID: CVE-2022-0538 [oss-security] 20220209 Vulnerability in Jenkins https://www.jenkins.io/security/advisory/2022-02-09/#SECURITY-2602
Copyright	Copyright (C) 2022 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.