---

CVE-2017-1000355 - log back

CVE-2017-1000355 created at 25 Sep 2019 19:31:40
Severity	+ Medium
Remote	+ Remote
Type	+ Arbitrary code execution
Description	+ Jenkins uses the XStream library to serialize and deserialize XML. Its maintainer recently published a security vulnerability that allows anyone able to provide XML to Jenkins for processing using XStream to crash the Java process. In Jenkins this typically applies to users with permission to create or configure items (jobs), views, or agents. + + Jenkins now prohibits the attempted deserialization of void / Void that results in a crash.
References	+ http://www.openwall.com/lists/oss-security/2017/04/03/4
Notes