CVE-2017-1000503
High
Description
A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands during initialization. This could in rare cases result in failure to initialize the setup wizard on the first startup. This resulted in multiple security-related settings not being set to their usual strict default.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Jenkins
PublishedJan 24, 2018
First seenJan 24, 2018
How to fix
Update
- org.jenkins-ci.main:jenkins-core2.89.2, 2.95 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jenkins jenkins | 2.81 ≤ v ≤ 2.94, 2.89.1 | — |
| org.jenkins-ci.main:jenkins-coreMaven | 2.81 ≤ v < 2.89.2, 2.90 ≤ v < 2.95 | 2.89.2, 2.95 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.