diff --git a/advisories/unreviewed/2022/05/GHSA-wfw7-6632-xcv2/GHSA-wfw7-6632-xcv2.json b/advisories/github-reviewed/2022/05/GHSA-wfw7-6632-xcv2/GHSA-wfw7-6632-xcv2.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-wfw7-6632-xcv2/GHSA-wfw7-6632-xcv2.json rename to advisories/github-reviewed/2022/05/GHSA-wfw7-6632-xcv2/GHSA-wfw7-6632-xcv2.json index bc3cc8dc985..24921dfa0c8 100644 --- a/advisories/unreviewed/2022/05/GHSA-wfw7-6632-xcv2/GHSA-wfw7-6632-xcv2.json +++ b/advisories/github-reviewed/2022/05/GHSA-wfw7-6632-xcv2/GHSA-wfw7-6632-xcv2.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-wfw7-6632-xcv2", - "modified": "2024-01-09T03:30:20Z", + "modified": "2024-01-09T16:32:01Z", "published": "2022-05-13T01:30:07Z", "aliases": [ "CVE-2015-8103" ], - "details": "The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the \"Groovy variant in 'ysoserial'\".", + "summary": "Jenkins CLI Deserialization of Untrusted Data vulnerability", + "details": "The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic `webapps/ROOT/WEB-INF/lib/commons-collections-*.jar` file and the \"Groovy variant in `ysoserial`\".", "severity": [ { "type": "CVSS_V3", @@ -14,7 +15,44 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:cli" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.625.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:cli" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.626" + }, + { + "fixed": "1.638" + } + ] + } + ] + } ], "references": [ { @@ -29,6 +67,10 @@ "type": "WEB", "url": "https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli" }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20151225025917/http://www.securityfocus.com/bid/77636" + }, { "type": "WEB", "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11" @@ -64,20 +106,15 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2015/11/18/2" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/77636" } ], "database_specific": { "cwe_ids": [ - "CWE-502", - "CWE-77" + "CWE-502" ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-01-09T16:32:01Z", "nvd_published_at": "2015-11-25T20:59:00Z" } } \ No newline at end of file