CVE-2017-1000355

Description

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

How to fix CVE-2017-1000355

To remediate CVE-2017-1000355, upgrade the affected package to a fixed version below.

• Maven/org.jenkins-ci.main:jenkins-core—upgrade to 2.57 or later

Is CVE-2017-1000355 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 2.50, < 2.57

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2017-1000355
• PATCHgithub.com/jenkinsci/jenkins
• WEBgithub.com/jenkinsci/jenkins/commit/701ea95a52afe53bee28f76a3f96eb0e578852e9
• WEBgithub.com/jenkinsci/jenkins/commit/f7075e60772bd2fa15bcc72450735641c168fed5