CVE-2024-43044

CVE-2024-43044 Description This script checks Jenkins instances for CVE-2024-43044 by retrieving the Jenkins version from the instance and comparing it against known vulnerable version ranges. CVE-2024-43044 : This vulnerability affects Jenkins core and remoting versions, allowing attackers to...

CVE-POC

SecNeural // CVE PoC Collection Authorized, defensive vulnera...

CVE-2026-70426

A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in th...

Agent-to-controller deserialization filter bypass

Jenkins uses the https://github.com/jenkinsci/remotingRemoting library typically agent.jar or remoting.jar for communication between the controller and agents via serialized Java objects. To protect against deserialization vulnerabilities, Jenkins enforces the https://jenkins.io/jep/200JEP-200...

jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE

A vulnerability was found in the Remoting library in Jenkins core, which handles communication between the Jenkins controller and agents. The ClassLoaderProxyfetchJar function may allow malicious agents or attackers with Agent/Connect permission to read arbitrary files from the Jenkins controller...

jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE

A vulnerability was found in the Remoting library in Jenkins core, which handles communication between the Jenkins controller and agents. The ClassLoaderProxyfetchJar function may allow malicious agents or attackers with Agent/Connect permission to read arbitrary files from the Jenkins controller...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.5, <=0.0.6), appscanstandard-integration:ibm-security-appscanstandard-scanner (>=1.0, <=2.0) +173 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (2.60)

org.jenkins-ci.main:remoting MAVEN version 2.60 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - aendter.jenkins.plugins:filesystem-list-parameter-plugin =0.0.5, =1.0, =0.1.1, =1.4, =3.2.2, =1.2, =0.0....

GHSA-H856-FFVV-XVR4 Jenkins Remoting library arbitrary file read vulnerability

Jenkins uses the Remoting library typically agent.jar or remoting.jar for the communication between controller and agents. This library allows agents to load classes and classloader resources from the controller, so that Java objects sent from the controller build steps, etc. can be executed on...

com.technicolor:eloyente (1.0), org.jenkins-ci.main:cli (>=1.490, <=1.493) +11 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (2.18)

org.jenkins-ci.main:remoting MAVEN version 2.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - com.technicolor:eloyente 1.0 - org.jenkins-ci.main:cli =1.490, =1.490, =1.490, =1.490, =1.490, =1.490,...

org.jenkins-ci.main:cli (>=2.191, <=2.192) potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (3.34)

org.jenkins-ci.main:remoting MAVEN version 3.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - org.jenkins-ci.main:cli =2.191, =2.192 Source cves: CVE-2024-43044 Source advisory: OSV:GHSA-H856-FFVV-X...

com.exxeta.jenkins.plugins:sidebar-update-notification (>=1.0.1, <=1.1.0), com.nirima.jenkins.repository:jenkins-maven-plugin (1.0) +22 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (2.21)

org.jenkins-ci.main:remoting MAVEN version 2.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - com.exxeta.jenkins.plugins:sidebar-update-notification =1.0.1, =1.2, =1.0.3, =1.0.5, =1.499, =1.499,...

org.jenkins-ci.main:cli (1.429), org.jenkins-ci.main:jenkins-core (1.429) +10 more potentially affected by CVE-2024-43044 via org.jenkins-ci.main:remoting (2.5)

org.jenkins-ci.main:remoting MAVEN version 2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:remoting and may be impacted: - org.jenkins-ci.main:cli 1.429 - org.jenkins-ci.main:jenkins-core 1.429 -...

Jenkins allows Execution of Code by Opening a JRMP Listener

The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener...

GHSA-2X9H-H3C4-WQQH Improper Neutralization of Special Elements used in an LDAP Query in Jenkins

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server...

Fedora Update for jenkins-remoting FEDORA-2016-93679a91df

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 24 : jenkins / jenkins-remoting (2016-93679a91df)

Security fix for CVE-2016-9299 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

[SECURITY] Fedora 24 Update: jenkins-remoting-2.62.3-1.fc24

This package is primarily used by Jenkins for slave node management, but it could be potentially reused outside of this project...

Fedora Update for jenkins-remoting FEDORA-2016-368780879d

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 25 Update: jenkins-remoting-2.62.3-1.fc25

This package is primarily used by Jenkins for slave node management, but it could be potentially reused outside of this project...

Fedora 25 : jenkins / jenkins-remoting (2016-368780879d)

Security fix for CVE-2016-9299 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...