CVE-2017-1000353: Deserialization of Untrusted Data
(updated )
An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java SignedObject
object to the Jenkins CLI, that would be deserialized using a new ObjectInputStream
, bypassing the existing denylist-based protection mechanism.
References
Detect and mitigate CVE-2017-1000353 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →