GHSA-G2XQ-2V27-4RH3 Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled config.xml submission in a way that allows them to handle HTTP requests afterwards. This can be used to...