Jenkins CVE-2017-1000355 Denial of Service Vulnerability

Bugtraq ID:	98066
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-1000355
Remote:	Yes
Local:	No
Published:	Apr 27 2017 12:00AM
Updated:	May 02 2017 12:11AM
Credit:	The vendor reported this issue.
Vulnerable:	XStream XStream 1.4.9 XStream XStream 1.4.8 Jenkins-Ci Jenkins LTS 2.46.1 Jenkins-Ci Jenkins LTS 2.32.2 Jenkins-Ci Jenkins LTS 2.32.1 Jenkins-Ci Jenkins LTS 2.19.3 Jenkins-Ci Jenkins LTS 2.19.2 Jenkins-Ci Jenkins LTS 1.652.2 Jenkins-Ci Jenkins LTS 1.651.2 Jenkins-Ci Jenkins LTS 1.651.1 Jenkins-Ci Jenkins LTS 1.642.2 Jenkins-Ci Jenkins LTS 1.642.1 Jenkins-Ci Jenkins LTS 1.625.3 Jenkins-Ci Jenkins LTS 1.625.2 Jenkins-Ci Jenkins LTS 1.625.1 Jenkins-Ci Jenkins LTS 1.609.1 Jenkins-Ci Jenkins LTS 1.580.1 Jenkins-Ci Jenkins LTS 1.565.3 Jenkins-Ci Jenkins 1.480.3 Jenkins-Ci Jenkins 1.480.2 Jenkins-Ci Jenkins 1.480.1 Jenkins-Ci Jenkins 1.409.3 Jenkins-Ci Jenkins 1.7.24 Jenkins-Ci Jenkins 2.56 Jenkins-Ci Jenkins 2.44 Jenkins-Ci Jenkins 2.43 Jenkins-Ci Jenkins 2.32 Jenkins-Ci Jenkins 2.31 Jenkins-Ci Jenkins 2.3 Jenkins-Ci Jenkins 2.2 Jenkins-Ci Jenkins 2.1 Jenkins-Ci Jenkins 2.0 Jenkins-Ci Jenkins 1.7.24.1 Jenkins-Ci Jenkins 1.656 Jenkins-Ci Jenkins 1.655 Jenkins-Ci Jenkins 1.654 Jenkins-Ci Jenkins 1.653 Jenkins-Ci Jenkins 1.652 Jenkins-Ci Jenkins 1.651 Jenkins-Ci Jenkins 1.650 Jenkins-Ci Jenkins 1.649 Jenkins-Ci Jenkins 1.641 Jenkins-Ci Jenkins 1.640 Jenkins-Ci Jenkins 1.638 Jenkins-Ci Jenkins 1.637 Jenkins-Ci Jenkins 1.600 Jenkins-Ci Jenkins 1.587 Jenkins-Ci Jenkins 1.578 Jenkins-Ci Jenkins 1.565.3-3 Jenkins-Ci Jenkins 1.551 Jenkins-Ci Jenkins 1.550 Jenkins-Ci Jenkins 1.532.2 Jenkins-Ci Jenkins 1.532.1 Jenkins-Ci Jenkins 1.523 Jenkins-Ci Jenkins 1.514 Jenkins-Ci Jenkins 1.513 Jenkins-Ci Jenkins 1.509.1 Jenkins-Ci Jenkins 1.509 Jenkins-Ci Jenkins 1.502 Jenkins-Ci Jenkins 1.497 Jenkins-Ci Jenkins 1.491 Jenkins-Ci Jenkins 1.482 Jenkins-Ci Jenkins 1.454 Jenkins-Ci Jenkins 1.452 Jenkins-Ci Jenkins 1.451 Jenkins-Ci Jenkins 1.447 Jenkins-Ci Jenkins 1.446 Jenkins-Ci Jenkins 1.438 Jenkins-Ci Jenkins 1.424.5.1 Jenkins-Ci Jenkins 1.424.5 Jenkins-Ci Jenkins 1.424.3 Jenkins-Ci Jenkins 1.424.2 Jenkins-Ci Jenkins 1.424.1 Jenkins-Ci Jenkins 1.408 Jenkins-Ci Jenkins 1.400.0.13 Jenkins-Ci Jenkins 1.400.0.12
Not Vulnerable:	Jenkins-Ci Jenkins LTS 2.46.2 Jenkins-Ci Jenkins 2.57

Jenkins CVE-2017-1000355 Denial of Service Vulnerability

Jenkins is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to crash the application, resulting in a denial-of-service condition.

The following versions are available:

Jenkins 2.56 and prior.
Jenkins LTS 2.46.1 and prior.

Jenkins CVE-2017-1000355 Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Jenkins CVE-2017-1000355 Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Jenkins CVE-2017-1000355 Denial of Service Vulnerability

References:

• Jenkins CI Homepage (Jenkins CI)
  
• Subject: CVE Request - XStream: DoS when unmarshalling void (openwall.com)
  
• Bug 1446128 - (CVE-2017-1000355) CVE-2017-1000355 jenkins: Java crash when tryi (Redhat)
  
• Jenkins Security Advisory 2017-04-26 (jenkins)