CloudBees Jenkins Multiple Vulnerabilities-02-May16 (Linux)

This host is installed with CloudBees Jenkins and is prone to multiple vulnerabilities.

Multiple flaws are due to, - The verification of user-provided API tokens with the expected value did not use a constant-time comparison algorithm, potentially allowing attackers to use statistical methods to determine valid API tokens using brute-force methods. - The verification of user-provided CSRF crumbs with the expected value did not use a constant-time comparison algorithm, potentially allowing attackers to use statistical methods to determine valid CSRF crumbs using brute-force methods. - The Jenkins has several API endpoints that allow low-privilege users to POST XML files that then get deserialized by Jenkins. Maliciously crafted XML files sent to these API endpoints could result in arbitrary code execution. - An HTTP response splitting vulnerability in the CLI command documentation allowed attackers to craft Jenkins URLs that serve malicious content. - The Jenkins remoting module allowed unauthenticated remote attackers to open a JRMP listener on the server hosting the Jenkins master process, which allowed arbitrary code execution.

CloudBees Jenkins LTS before 1.642.2 on Linux

Checks if a vulnerable version is present on the target host.

Upgrade to CloudBees Jenkins LTS 1.642.2 or later.