Bug 1446128 (CVE-2017-1000355)

Summary: CVE-2017-1000355 jenkins: Java crash when trying to instantiate void/Void (SECURITY-503)
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhgupta, bleanhar, ccoleman, dedgar, dmcphers, java-sig-commits, jgoulding, joelsmith, mizdebsk, msrb, ngaywood, tdawson, tiwillia
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: jenkins 2.46.2, jenkins 2.57 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-21 11:53:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1446133, 1446134    
Bug Blocks: 1395176, 1446135    

Description Adam Mariš 2017-04-27 10:00:58 UTC 
Jenkins uses the XStream library to serialize and deserialize XML. Its maintainer recently published a security vulnerability that allows anyone able to provide XML to Jenkins for processing using XStream to crash the Java process. In Jenkins this typically applies to users with permission to create or configure items (jobs), views, or agents.

Jenkins now prohibits the attempted deserialization of void / Void that results in a crash.

Affected versions:

    All Jenkins main line releases up to and including 2.56
    All Jenkins LTS releases up to and including 2.46.1

Fixed in:

    Jenkins main line users should update to 2.57
    Jenkins LTS users should update to 2.46.2

External References:

https://jenkins.io/security/advisory/2017-04-26/#xstream-java-crash-when-trying-to-instantiate-void-void
http://www.openwall.com/lists/oss-security/2017/04/03/4
Comment 1 Adam Mariš 2017-04-27 10:01:25 UTC 
Acknowledgments:

Name: the Jenkins project
Comment 2 Adam Mariš 2017-04-27 10:08:46 UTC 
Created jenkins tracking bugs for this issue:

Affects: fedora-all [bug 1446133]
Affects: openshift-1 [bug 1446134]
Comment 3 Norman Gaywood 2017-05-19 01:29:43 UTC 
Any update on these issues?

The security team here are wanting me to make their scan notices about this go away.